Page MenuHomeVyOS Platform

Can not create two GRE tunnels to the same DST but from different SRC addresses
In progress, NormalPublicBUG

Description

Cannot create two GRE tunnels to the same DST but from different SRC addresses
Configuration:

set interfaces ethernet eth1 address '10.0.0.2/24'
set interfaces ethernet eth2 address '10.0.1.2/24'
set protocols static route 0.0.0.0/0 next-hop 10.0.0.1

Adding tunnels

set interfaces tunnel tun100 address '192.168.8.100/31'
set interfaces tunnel tun100 encapsulation 'gre'
set interfaces tunnel tun100 ip adjust-mss '1436'
set interfaces tunnel tun100 remote '10.0.10.2'
set interfaces tunnel tun100 source-address '10.0.0.2'

set interfaces tunnel tun102 address '192.168.8.104/31'
set interfaces tunnel tun102 encapsulation 'gre'
set interfaces tunnel tun102 ip adjust-mss '1436'
set interfaces tunnel tun102 remote '10.0.10.2'
set interfaces tunnel tun102 source-address '10.0.1.2'

Getting error after commit

vyos@vyos# commit
[ interfaces tunnel tun100 ]
Missing required "ip key" parameter when running more then one GRE based
tunnel on the same source-interface/source-address

[[interfaces tunnel tun100]] failed
[ interfaces tunnel tun102 ]
Missing required "ip key" parameter when running more then one GRE based
tunnel on the same source-interface/source-address

[[interfaces tunnel tun102]] failed
Commit failed
[edit]
vyos@vyos#

After adding such interfaces manually everything works. I can ping all remote sites through tunnels.

Details

Difficulty level
Unknown (require assessment)
Version
VyOS 1.5-rolling-202403220018, VyOS 1.3.6
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

a.apostoliuk triaged this task as Normal priority.
a.apostoliuk changed the task status from Open to In progress.Apr 4 2024, 11:08 AM
a.apostoliuk claimed this task.
a.apostoliuk changed the task status from In progress to Open.May 17 2024, 7:37 AM
a.apostoliuk removed a.apostoliuk as the assignee of this task.

As far as I can tell the test will always error if the remote matches and neither source-interface and source-address are configured differently, including the case where they're both blank (source-interface == None on both tunnels triggers this particular case).

The test can be modified to instead check that at least one out of (source-if, source-address, remote) differ against existing tunnels which will allow the tunnel to be created cleanly, I've attached a patch that works this way.

However, it can't easily check things like one tunnel configured with the source-address of an interface, another tunnel configured with the same IF directly as source-interface - this doesn't stop ip from working underneath and creating the tunnel, but will likely confuse NAT & conntrack.

{F4328120}

talmakion attached a referenced file: Unknown Object (File). (Show Details)May 25 2024, 10:21 AM

I've created a PR for this that fixed a mistake with my original patch: https://github.com/vyos/vyos-1x/pull/3570

Viacheslav changed the task status from Open to In progress.May 31 2024, 12:37 PM
Viacheslav assigned this task to talmakion.

@a.apostoliuk this one should be resolved in the current rolling release, if you're able to check it out?