Community discussions

MikroTik App
 
davelegg
just joined
Topic Author
Posts: 1
Joined: Wed Jan 17, 2018 6:58 pm

EoIP (+IPSec) interface status

Wed Jan 17, 2018 7:04 pm

I'm having an issue with the configuration of a site-to-site link I'm trying to create using EoIP.

One site has two ISPs for redundancy, as both experience occasional dropouts. I have created an EoIP tunnel over each connection to the router at the other site (a datacenter), and the tunnels are secured with IPSec.

I have noticed however that the tunnel interfaces will show as Running, even if the underlying IPSec connection is not established. For example, if I disable the EoIP interface on one end, the IPSec connection will drop out, which I can see through IP > IPSec, but the EoIP interface on the other end will still show as running.

I am wanting to bond the two connections so that while both ISPs are up, I can get increased throughput to the datacenter, but as the EoIP interfaces always appear to be running, the bond isn't seeing when one connection drops out, and is still trying to send traffic through that interface.

Is there something here I'm doing wrong? How can I get the EoIP interfaces to properly reflect if they are connected or not?
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4047
Joined: Wed May 11, 2011 6:08 pm

Re: EoIP (+IPSec) interface status

Wed Jan 17, 2018 9:49 pm

Try using OSPF across the tunnel. As long as the two interfaces have the same cost, OSPF will use equal-cost multipath routing (EQMP) to load share between the two paths. If one path fails, OSPF will lose adjacency across it regardless of the interface's up/down state.
 
User avatar
doneware
Trainer
Trainer
Posts: 647
Joined: Mon Oct 08, 2012 8:39 pm
Location: Hungary

Re: EoIP (+IPSec) interface status

Thu Jan 18, 2018 12:35 pm

I have noticed however that the tunnel interfaces will show as Running, even if the underlying IPSec connection is not established. For example, if I disable the EoIP interface on one end, the IPSec connection will drop out, which I can see through IP > IPSec, but the EoIP interface on the other end will still show as running.
use keepalives on the interface. w/o keepalives the router cannot figure out whether the tunnel is working or not.

to be honest, the name "tunnel" is a bit confusing. Indeed it's a tunnel, but it's essentially stateless. there ain't no control mechanism behind it.
just look at it as follows:

you put certain bytes in front of your IP packet (that's referred as tunnel header) and glue another IP header to it (alltogether called tunnel overhead) and expect that someone on the far side has configured a mechanism to strip'em down and forward you original IP packet. then imagine a separate flow that works backwards.
either way you just can't tell whether it's working unless you have traffic on it. this is where keepalives come into the picture.

or as Zerobyte said, if you run any dynamic routing protocol over the tunnel that might steer traffic onto it - as long the OSPF or BGP can talk to the far side, they will know, it's reachable, so they will use the received routing updates to steer your traffic onto the tunnel. whenever the tunnel stops transmitting your data (and implicitly the routing PDUs, so no HELLOs or BGP keepalives is received from the peer) the neighbourship will go down, and without received routes the traffic will be moved off from the non-working tunnel.

keepalives do the same, but they might rely on the far end a bit less than dynamic routing protocols. you specify the interval how often these small keepalives shall be sent (say 1-10sec) and the number of failed receptions after the tunnel will be declared as "down" or "not running". then it's just works.
indeed it provides less visibility compared to a proper dynamic routing session where your routers can "see" behind the far end device, but in most cases you will be just ok.
some ISPs will simply not establish no dynamic routing with you unless you pay them extra $$.
 
User avatar
doneware
Trainer
Trainer
Posts: 647
Joined: Mon Oct 08, 2012 8:39 pm
Location: Hungary

Re: EoIP (+IPSec) interface status

Thu Jan 18, 2018 12:38 pm

if you use the EoIP to bridge the two distant LANs together, tunnel keepalives will be your only option.
 
plnx
just joined
Posts: 1
Joined: Thu Jan 18, 2018 8:36 pm

Re: EoIP (+IPSec) interface status

Thu Jan 18, 2018 8:47 pm

if you´re using 2 eoip tunnels, you can use a bonding to decide
which tunnel use, something like that:

interface bonding add name="bonding-datacenter" mtu=1500 mac-address=<RANDOM_MAC_ADDRESS> arp=enabled arp-timeout=auto slaves=eoip1,eoip2 mode=balance-xor primary=none link-monitoring=arp arp-interval=100ms arp-ip-targets=<IP_OF_BONDING_ON_OTHER_SIDE> mii-interval=100ms down-delay=0ms up-delay=5s lacp-rate=1sec transmit-hash-policy=layer-3-and-4 min-links=0

Who is online

Users browsing this forum: clambert, GoogleOther [Bot], intania, phascogale and 216 guests