Ethernet over GRE

Ethernet over GRE

Ethernet over GRE (EoGRE) is an aggregation solution that

  • groups Wi-Fi traffic from hotspots

  • enables customer premises equipment (CPE) devices to bridge Ethernet traffic coming from an end-host and encapsulate the traffic in Ethernet packets over an IP Generic Routing Encapsulation (GRE) tunnel, and

  • forwards end-host traffic and initiates subscriber sessions when IP GRE tunnels are terminated on a service provider's broadband network gateway.

Client IPv6 traffic

Client IPv6 traffic is supported on IPv4 EoGRE tunnels. A maximum of eight different client IPv6 addresses are supported per client. Wireless controllers send all the client IPv6 addresses that they have learned to the accounting server using the accounting update message. All RADIUS or accounting messages exchanged between controllers and tunnel gateways or RADIUS servers are outside the EoGRE tunnel.

To enable EoGRE for a WLAN, the wireless policy profile should be mapped to a tunnel profile, which may contain:

  • AAA override: Allows you to bypass rule filtering for a client.

  • Gateway RADIUS proxy: Allows forwarding of AAA requests to tunnel gateways.

  • Tunnel rules: Defines the domain to use for each realm. They also define VLAN tagging for the client traffic towards tunnel gateways.

  • DHCP option 82: Provides a set of predefined fields.

EoGRE deployment with multiple tunnel gateways

The wireless controller sends keepalive pings to the primary and secondary tunnel gateways and keeps track of the missed pings. When a certain threshold level is reached for the missed pings, switchover is performed and the secondary tunnel is marked as active. This switchover deauthenticates all the clients to enable them to rejoin the access points (APs). When the primary tunnel come back online, all the client traffic are reverted to the primary tunnel. However, this behavior depends on the type of redundancy.

Load balancing in EtherChannels

Load balancing of tunneled traffic over Etherchannels works by hashing the source or destination IP addresses or MAC addresses of the tunnel endpoint pair. Because the number of tunnels is very limited when compared to clients (each tunnel carries traffic for many clients), the spreading effect of hashing is highly reduced and optimal utilization of Etherchannel links can be hard to achieve.

Using the EoGRE configuration model, you can use the tunnel source option of each tunnel interface to adjust the load-balancing parameters and spread tunnels across multiple links.

You can use different source interfaces on each tunnel for load balancing based on the source or destination IP address. For that choose the source interface IP address in such a way that traffic flows take different links for each src-dest IP pair. This is an example with four ports: 

Client traffic on Tunnel1 – Src IP: 40.143.0.72  Dest IP: 40.253.0.2
Client traffic on Tunnel2 – Src IP: 40.146.0.94  Dest IP: 40.253.0.6
Client traffic on Tunnel3 – Src IP: 40.147.0.74  Dest IP: 40.253.0.10

Use the show platform software port-channel link-select interface port-channel 4 ipv4 src_ip dest_ip command to determine the link that a particular flow will take.

EoGRE configuration

EoGRE configuration is a network deployment approach that

  • supports two different deployment modes: Central-Switching and Flex or Local-Switching

  • uses tunnel gateways, tunnel domains, and tunnel profiles to manage client traffic, and

  • enables secure tunneling through policy profiles mapped to WLANs using policy tags.

EoGRE deployment modes

The EoGRE solution can be deployed in two different ways:

  • Central-Switching: EoGRE tunnels connect the controller to the tunnel gateways.

  • Flex or Local-Switching: EoGRE tunnels are initiated on the APs and terminated on the tunnel gateways.

To configure EoGRE, perform these tasks:

  1. Create a set of tunnel gateways.

  2. Create a set of tunnel domains.

  3. Create a tunnel profile with rules that define how to match clients to domains.

  4. Create a policy profile and attach the tunnel profile to it.

  5. Map the policy profile to WLANs using policy tags.


Note

The EoGRE tunnel fallback to the secondary tunnel is triggered after the max-skip-count ping fails in the last measurement window. Based on the starting and ending instance of the measurement window, the fall-back may take more time than the duration that is configured.

EoGRE supports multiple authentication methods:

Table 1. EoGRE authentication methods

Method Name

First Supported Release

Mode

PSK

17.2.1

Local/Flex (central authentication)

Open

16.12.1

Local/Flex (central authentication)

LWA

16.12.1

Local/Flex (central authentication)

Dot1x

16.12.1

Local/Flex (central authentication)

CWA

16.12.1

Local/Flex (central authentication)

Create a tunnel gateway (CLI)

Establish a tunnel gateway for secure communication between network segments.
In the controller, a tunnel gateway is modeled as a tunnel interface.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Configure a tunnel interface and enter interface configuration mode.

Example:

Device(config)# interface tunnel tunnel-number

Example:

Device(config)# interface tunnel 21

Step 3

Set the source address of the tunnel interface.

Example:

Device(config-if)# tunnel source source-interface

Example:

Device(config-if)# tunnel source 22

The source interface can be VLAN, Gigabit Ethernet or loopback.

Step 4

Set the destination address of the tunnel.

Example:

Device(config-if)# tunnel destination tunnel-address

Example:

Device(config-if)# tunnel destination 10.11.12.13

Step 5

Set the encapsulation mode of the tunnel to Ethernet over GRE IPv4 or Ethernet over GRE IPv6.

Example:

Device(config-if)# tunnel mode ethernet gre {ipv4 | ipv6} p2p

Example:

Device(config-if)# tunnel mode ethernet gre ipv4 p2p
The tunnel gateway is configured and ready to establish secure connections between network segments.

Configure the tunnel gateway (GUI)

Configure the tunnel gateway to establish network tunneling connections through the graphical user interface.

Use the GUI to set up tunnel gateway parameters including tunnel identification, destination addressing, source interface selection, and AAA proxy configuration when needed.

Procedure

Step 1

Choose Configuration > Tags & Profiles > EoGRE.

Step 2

Click the Gateways tab.

The Add Gateway window is displayed.

Step 3

In the Tunnel ID field, specify the tunnel ID.

Step 4

In the Destination address (IPv4/IPv6) field, specify the IPv4 or IPv6 address.

Step 5

From the Source Interface drop-down list, select an interface.

Step 6

In the AAA Proxy section, slide the AAA Proxy slider to Enabled. When AA Proxy is enabled, complete these steps:

  1. From the ENCRYPTION Type drop-down list, select either UNENCRYPTED or AES ENCRYPTION.

  2. In the Key Phrase field, specify the key phrase.

Step 7

Click Apply to Device.

The tunnel gateway is configured with the specified parameters and applied to the device.

Configure a tunnel domain (CLI)

This task creates a tunnel domain to group tunnels for redundancy purposes, ensuring High Availability by designating primary and secondary tunnels with specific failover behavior.


Note

Tunnel domains are a redundancy grouping of tunnels. This configuration procedure specifies a primary and a secondary tunnel, along with a redundancy model.

At any point of time, only one tunnel will be active per domain. The primary tunnel will be active when tunnel domain is setup. When the primary tunnel goes down (heartbeats are skipped), a switchover to the secondary tunnel is performed.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Configure EoGRE redundancy domain. tunnel eogre domain domain

Example:

Device(config)# tunnel eogre domain domain
Device(config)# tunnel eogre domain dom1

Step 3

Configure the primary tunnel.

Example:

Device(config-eogre-domain)# primary tunnel primary-tunnel_intf
Device(config-eogre-domain)# primary tunnel 21

Step 4

Configure the secondary tunnel.

Example:

Device(config-eogre-domain)# secondary tunnel secondary-tunnel_intf
Device(config-eogre-domain)# secondary tunnel 22

Step 5

Set the redundancy model as revertive.

Example:

Device(config-eogre-domain)# redundancy revertive

When redundancy is set to revertive and the primary tunnel goes down, a switchover to secondary tunnel is performed. When the primary tunnel comes back up, a switchover to the primary tunnel is performed, because the primary tunnel has priority over the secondary tunnel.

When redundancy is not set to revertive, tunnels will have the same priority, and a switchover to the primary tunnel is not performed if the active tunnel is the secondary tunnel and the primary tunnel comes back up.

The tunnel domain is configured with designated primary and secondary tunnels. The primary tunnel will be active initially, and automatic failover to the secondary tunnel will occur if the primary tunnel becomes unavailable. If revertive redundancy is configured, the system will switch back to the primary tunnel when it becomes available again.

Configure tunnel domain (GUI)

Configure the tunnel domain to establish EoGRE connectivity with primary and secondary tunnel gateways.

Use this procedure to set up tunnel domains through the graphical user interface, including gateway selection and redundancy options.

Follow these steps to configure the tunnel domain:

Procedure

Step 1

Choose Configuration > Tags & Profiles > EoGRE.

Step 2

Click the Domains tab.

The Add Domain window is displayed.

Step 3

In the Name field, specify the domain name.

The name can be ASCII characters from 32 to 126, without leading and trailing spaces.

Step 4

From the Primary Tunnel Gateway drop-down list, choose an option.

Step 5

From the Secondary Tunnel Gateway drop-down list, choose an option.

Step 6

Slide the Status button to Enabled, to activate the domain status.

Step 7

Slide the Revertive Redundancy button to Enabled, to activate revertive redundancy.

Step 8

Click Apply to Device.

The tunnel domain is configured with the specified settings and applied to the device.

Configure EoGRE global parameters CLI)

Establish EoGRE tunnel parameters including heartbeat intervals, skip counts, source interfaces, and AAA proxy keys for proper tunnel operation.
EoGRE (Ethernet over Generic Routing Encapsulation) global parameters control tunnel behavior across the network. These settings ensure reliable tunnel communication and proper failover handling.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Set EoGRE tunnel heartbeat periodic interval.

Example:

Device(config)# tunnel eogre heartbeat interval interval-value

Example:

Device(config)# tunnel eogre heartbeat interval 600

Step 3

Set the maximum number of tolerable dropped heartbeats.

Example:

Device(config)# tunnel eogre heartbeat max-skip-count skip-count

Example:

Device(config)# tunnel eogre heartbeat max-skip-count 7

After reaching the maximum number of heartbeats that can be dropped, the tunnel is declared as down and a switchover is performed.

Step 4

Set the tunnel EoGRE source interface.

Example:

Device(config)# tunnel eogre source loopback tunnel-source

Example:

Device(config)# tunnel eogre source loopback 12

Step 5

(Optional) Configure AAA proxy RADIUS key for the AAA proxy setup.

Example:

Device(config)# tunnel eogre interface tunnel tunnel-intf aaa proxy key key key-name

Example:

Device(config)# tunnel eogre interface tunnel 21 aaa proxy key 0 mykey

Note

 

When the tunnel gateway is behaving as the AAA proxy server, only this step is required for the configuration.
EoGRE global parameters are configured with the specified heartbeat interval, maximum skip count, source interface, and optional AAA proxy key settings.

Configure EoGRE global parameters (GUI)

The EoGRE global parameters define the network-wide settings for Ethernet over Generic Routing Encapsulation tunnels, including heartbeat intervals and interface assignments.

Use this task to establish the fundamental EoGRE configuration parameters that will apply across your network infrastructure.

Procedure

Step 1

Choose Configuration > Tags & Profiles > EoGRE.

The EoGRE Global Config tab is displayed.

Step 2

In the Heartbeat Interval (seconds) field, specify an appropriate timer value for heartbeat interval. The valid range is from 60 to 600 seconds.

Step 3

In the Max Heartbeat Skip Count field, specify the maximum heartbeat skip count. The valid range is from 3 to 10.

Step 4

From the Interface Name drop-down list, choose an interface name.

Step 5

Click Apply.

The EoGRE global parameters are configured and applied to your network infrastructure.

Configure a tunnel profile (CLI)

Create and configure a tunnel profile to manage client traffic routing and authentication through tunneled connections.
Tunnel profiles define how client traffic is handled when using tunneled connections, including DHCP options, AAA overrides, and RADIUS proxy settings. This configuration is essential for managing client authentication and traffic routing in wireless environments.

Before you begin

Ensure that you define the destination VLAN on the controller. If you do not define the VLAN, clients will not be able to connect.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Configure a WLAN policy profile.

Example:

Device(config)# wireless profile policy profile-policy-name

Example:

Device(config)# wireless profile policy eogre_policy

Step 3

Create a tunnel profile.

Example:

Device(config-wireless-policy)# tunnel-profile tunnel-profile-name

Example:

Device(config-wireless-policy)# tunnel-profile tunnel1

Step 4

Return to global configuration mode.

Example:

Device(config-wireless-policy)# exit

Step 5

Configure a wireless tunnel profile.

Example:

Device(config)# wireless profile tunnel tunnel-profile-name

Example:

Device(config)# wireless profile tunnel wl-tunnel-1

Step 6

Activate DHCP Option 82 for the tunneled clients.

Example:

Device(config-tunnel-profile)# dhcp-opt82 enable

Step 7

Configure Remote ID options.

Example:

Device(config-tunnel-profile)# dhcp-opt82 remote-id remote-id

Example:

Device(config-tunnel-profile)# dhcp-opt82 remote-id vlan

Choose from the comma-separated list of options such as ap-mac, ap-ethmac, ap-name, ap-group-name, flex-group-name, ap-location, VLAN, ssid-name, ssid-type, and client-mac.

Step 8

Enable AAA policy override.

Example:

Device(config-tunnel-profile)# aaa-override

Step 9

Enable the gateway RADIUS proxy.

Example:

Device(config-tunnel-profile)# gateway-radius-proxy

Step 10

Enable the gateway accounting RADIUS proxy.

Example:

Device(config-tunnel-profile)# gateway-accounting-radius-proxy

Step 11

Create a rule to choose a domain, using the realm filter, for client Network Access Identifier (NAI), tunneling domain name, and destination VLAN.

Example:

Device(config-tunnel-profile)# rule priority realm-filter realm domain domain-name vlan vlan-id

Example:

Device(config-tunnel-profile)# rule 12 realm-filter realm domain dom1 vlan 5
The tunnel profile is now configured with the specified settings for DHCP options, AAA overrides, RADIUS proxy, and filtering rules, enabling proper client traffic management through tunneled connections.

Configure the tunnel profile (GUI)

Configure a tunnel profile to define the parameters and settings for establishing tunnel connections in the EoGRE environment.

Use this procedure to create and configure tunnel profiles that manage tunnel connections and their associated settings through the graphical user interface.

Follow these steps to configure the tunnel profile:

Procedure

Step 1

Choose Configuration > Tags & Profiles > EoGRE.

Step 2

Click the Tunnel Profiles tab.

Step 3

Click the Add button.

The Add Tunnel Profile window is displayed.

Step 4

Click the General tab and complete these steps:

  1. In the Name field, specify the tunnel profile name. The name can be ASCII characters from 32 to 126, without leading and trailing spaces.

  2. In the Status field, slide the button to change the status to Enabled.

  3. In the Central Forwarding field, slide the button to Enabled, to enable the feature.

  4. In the DHCP Option-82 section, change the Status field and the ASCII field to Enabled, as per requirement.

  5. In the Delimiter field, specify the delimiter.

  6. From the Circuit ID Available Services list, select an available services and click the > sign to add the services to the assigned list.

  7. From the Remote ID Available Services list, select an available services and click the > sign to add the services to the assigned list.

  8. In the AAA section, choose an appropriate status for the Radius Proxy field, the Accounting Proxy field, and the Override field.

Step 5

Click the Rules tab, and complete these steps:

  1. Click the Add Rules button.

  2. In the Priority field, specify the priority of the rule from a range of 1 to 100.

  3. In the Realm field, specify a realm.

  4. From the Domain drop-down list, choose a domain.

  5. In the VLAN ID field, specify the VLAN ID that ranges from 1 to 4094.

  6. Click Save.

Step 6

Click Apply to Device.

The tunnel profile is successfully configured and applied to the device with the specified settings for tunnel connections.

Associate WLAN to a wireless policy profile (CLI)

Associate a WLAN with a wireless policy profile to apply specific policies and configurations to wireless network traffic.
When managing wireless networks, you need to associate WLANs with policy profiles to ensure proper traffic handling and security configurations are applied to wireless clients.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Configure a policy tag and enter policy tag configuration mode.

Example:

Device(config)# wireless tag policy policy-tag-name

Example:

Device(config)# wireless tag policy eogre_tag

Step 3

Map an EoGRE policy profile to a WLAN profile.

Example:

Device(config-policy-tag)# wlan wlan-name policy profile-policy-name

Example:

Device(config-policy-tag)# wlan eogre_open_eogre policy eogre_policy

Step 4

Save the configuration, exit configuration mode, and return to privileged EXEC mode.

Example:

Device(config-policy-tag)# end
The WLAN is now associated with the specified wireless policy profile, and the configured policies will be applied to wireless traffic on that WLAN.

Attach a policy tag and a site tag to an AP

Associate policy and site tags with an AP to apply specific network policies and location-based configurations.
Policy tags define network behaviors and WLAN mappings for APs, while site tags specify location-based settings like DNS servers and local switching parameters. Both tags must be attached to APs to ensure proper network operation.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Configure an AP and enter AP profile configuration mode.

Example:

Device(config)# ap mac-address

Example:

Device(config)# ap 80E8.6FD4.0BB0

Step 3

Map the policy tag to the AP.

Example:

Device(config-ap-tag)# policy-tag policy-tag-name

Example:

Device(config-ap-tag)# policy-tag eogre_tag

Step 4

Map a site tag to the AP.

Example:

Device(config-ap-tag)# site-tag site-tag-name

Example:

Device(config-ap-tag)# site-tag sp-flex-site

Step 5

Save the configuration, exit configuration mode, and return to privileged EXEC mode.

Example:

Device(config-ap-tag)# end
The AP is now configured with the specified policy tag and site tag, enabling it to apply the associated network policies and location-based settings.

Verify EoGRE tunnel configuration

The show tunnel eogre command displays the EoGRE clients, domains, gateways, global-configuration, and manager information in the local mode.

To display the EoGRE domain summary in the local mode, use this command:

Device# show tunnel eogre domain summary                
Domain Name         Primary GW   Secondary GW      Active GW      Redundancy
-------------------------------------------------------------------------------
domain1             Tunnel1      Tunnel2           Tunnel1        Non-Revertive
eogre_domain        Tunnel1      Tunnel2           Tunnel1        Non-Revertive

To display the details of an EoGRE domain in the local mode, use this command:

Device# show tunnel eogre domain detailed domain-name
 Domain Name   : eogre_domain
 Primary GW    : Tunnel1
 Secondary GW  : Tunnel2
 Active GW     : Tunnel1
 Redundancy    : Non-Revertive

To view the EoGRE tunnel gateway summary and statistics in the local mode, use this command:

Device# show tunnel eogre gateway summary                
Name               Type  Address                                  AdminState  State  Clients
---------------------------------------------------------------------------------------------
Tunnel1            IPv4  9.51.1.11                                Up          Up     0       
Tunnel2            IPv4  9.51.1.12                                Up          Down   0       
Tunnel10           IPv6  fd09:9:8:21::90                          Down        Down   0       
Tunnel11           IPv4  9.51.1.11                                Up          Up     0       
Tunnel12           IPv6  fd09:9:8:21::90                          Up          Down   0       
Tunnel100          IPv4  9.51.1.100                               Up          Down   0

To view the details of an EoGRE tunnel gateway in the local mode, use this command:

Device# show tunnel eogre gateway detailed gateway-name
Gateway : Tunnel1
 Mode   : IPv4
 IP     : 9.51.1.11
 Source : Vlan51 / 9.51.1.1
 State  : Up
 SLA ID : 56
 MTU    : 1480
 Up Time: 4 minutes 45 seconds 
 Clients
  Total Number of Wireless Clients      : 0
 Traffic
  Total Number of Received Packets      : 0
  Total Number of Received Bytes        : 0
  Total Number of Transmitted Packets   : 0
  Total Number of Transmitted Bytes     : 0
 Keepalives
  Total Number of Lost Keepalives       : 0
  Total Number of Received Keepalives   : 5
  Total Number of Transmitted Keepalives: 5
  Windows                               : 1
  Transmitted Keepalives in last window : 2
  Received Keepalives in last window    : 2

To view the client summary of EoGRE in the local mode, use this command: 

Device# show tunnel eogre client summary
Client MAC      AP MAC          Domain                            Tunnel        VLAN  Local
-------------------------------------------------------------------------------------------
74da.3828.88b0  80e8.6fd4.9520  eogre_domain                      N/A           2121   No

To view the details of an EoGRE global configuration in the local mode, use this command: 

Device# show tunnel eogre global-configuration
Heartbeat interval       : 60
Max Heartbeat skip count : 3
Source Interface         : (none)

To view the details of the global tunnel manager statistics in the local mode, use this command: 

Device# show tunnel eogre manager stats global
Tunnel Global Statistics
Last Updated                     : 02/18/2019 23:50:35
EoGRE Objects
  Gateways                       : 6
  Domains                        : 2
EoGRE Flex Objects
  AP Gateways                    : 2
  AP Domains                     : 1
  AP Gateways HA inconsistencies : 0
  AP Domains HA inconsistencies  : 0
Config events
  IOS Tunnel updates             : 806
  IOS Domain updates             : 88
  Global updates                 : 48
  Tunnel Profile updates         : 120
  Tunnel Rule updates            : 16
  AAA proxy key updates          : 0
AP events
  Flex AP Join                   : 1
  Flex AP Leave                  : 0
  Local AP Join                  : 0
  Local AP leave                 : 0
  Tunnel status (rx)             : 4
  Domain status (rx)             : 1
  IAPP stats msg (rx)            : 3
  Client count (rx)              : 6
  VAP Payload msg (tx)           : 4
  Domain config (tx)             : 1
  Global config (tx)             : 1
  Client delete (tx)             : 1
  Client delete per domain (tx)  : 3
  DHCP option 82 (tx)            : 4
Client events
  Add-mobile                     : 2
  Run-State                      : 3
  Delete                         : 1
  Cleanup                        : 0
  Join                           : 2
  Plumb                          : 0
  Join Errors                    : 0
  HandOff                        : 0
  MsPayload                      : 2
  FT Recover                     : 0
  Zombie GW counter increase     : 0
  Zombie GW counter decrease     : 0
  Tunnel Profile reset           : 88
  Client deauth                  : 0
  HA reconciliation              : 0
Client Join Events
  Generic Error                  : 0
  MSPayload Fail                 : 0
  Invalid VLAN                   : 0
  Invalid Domain                 : 0
  No GWs in Domain               : 0
  Domain Shut                    : 0
  Invalid GWs                    : 0
  GWs Down                       : 0
  Rule Match Error               : 0
  AAA-override                   : 0
  Flex No Active GW              : 0
  Open Auth join attempt         : 2
  Dot1x join attempt             : 2
  Mobility join attempt          : 0
  Tunnel Profile not valid       : 2
  Tunnel Profile valid           : 2
  No rule match                  : 0
  Rule match                     : 2
  AAA proxy                      : 0
  AAA proxy accounting           : 0
  AAA eogre attributes           : 0
  Has aaa override               : 0
  Error in handoff payload       : 0
  Handoff AAA override           : 0
  Handoff no AAA override        : 0
  Handoff payload received       : 0
  Handoff payload sent           : 0
SNMP Traps
  Client                         : 0
  Tunnel                         : 2
  Domain                         : 0
IPC
  IOSd TX messages               : 0
Zombie Client
  Entries                        : 0

To view the tunnel manager statistics of a specific process instance in the local mode, use this command:

Device# show tunnel eogre manager stats instance instance-number
Tunnel Manager statistics for process instance : 0
Last Updated                     : 02/18/2019 23:50:35
EoGRE Objects
  Gateways                       : 6
  Domains                        : 2
EoGRE Flex Objects
  AP Gateways                    : 2
  AP Domains                     : 1
  AP Gateways HA inconsistencies : 0
  AP Domains HA inconsistencies  : 0
Config events
  IOS Tunnel updates             : 102
  IOS Domain updates             : 11
  Global updates                 : 6
  Tunnel Profile updates         : 15
  Tunnel Rule updates            : 2
  AAA proxy key updates          : 0
AP events
  Flex AP Join                   : 1
  Flex AP Leave                  : 0
  Local AP Join                  : 0
  Local AP leave                 : 0
  Tunnel status (rx)             : 4
  Domain status (rx)             : 1
  IAPP stats msg (rx)            : 3
  Client count (rx)              : 6
  VAP Payload msg (tx)           : 4
  Domain config (tx)             : 1
  Global config (tx)             : 1
  Client delete (tx)             : 1
  Client delete per domain (tx)  : 3
  DHCP option 82 (tx)            : 4
Client events
  Add-mobile                     : 2
  Run-State                      : 3
  Delete                         : 1
  Cleanup                        : 0
  Join                           : 2
  Plumb                          : 0
  Join Errors                    : 0
  HandOff                        : 0
  MsPayload                      : 2
  FT Recover                     : 0
  Zombie GW counter increase     : 0
  Zombie GW counter decrease     : 0
  Tunnel Profile reset           : 11
  Client deauth                  : 0
  HA reconciliation              : 0
Client Join Events
  Generic Error                  : 0
  MSPayload Fail                 : 0
  Invalid VLAN                   : 0
  Invalid Domain                 : 0
  No GWs in Domain               : 0
  Domain Shut                    : 0
  Invalid GWs                    : 0
  GWs Down                       : 0
  Rule Match Error               : 0
  AAA-override                   : 0
  Flex No Active GW              : 0
  Open Auth join attempt         : 2
  Dot1x join attempt             : 2
  Mobility join attempt          : 0
  Tunnel Profile not valid       : 2
  Tunnel Profile valid           : 2
  No rule match                  : 0
  Rule match                     : 2
  AAA proxy                      : 0
  AAA proxy accounting           : 0
  AAA eogre attributes           : 0
  Has aaa override               : 0
  Error in handoff payload       : 0
  Handoff AAA override           : 0
  Handoff no AAA override        : 0
  Handoff payload received       : 0
  Handoff payload sent           : 0
SNMP Traps
  Client                         : 0
  Tunnel                         : 2
  Domain                         : 0
IPC
  IOSd TX messages               : 0
Zombie Client
  Entries                        : 0

The show ap tunnel eogre command displays the tunnel domain information, EoGRE events, and the tunnel gateway status on the APs, in the flex mode.

To view the summary information of an EoGRE tunnel gateway in the flex mode, use this command: 

Device# show ap tunnel eogre domain summary
AP MAC          Domain                           Active Gateway
-------------------------------------------------------------------------------
80e8.6fd4.9520  eogre_domain                     Tunnel1

To view the wireless tunnel profile summary, use this command: 

Device# show wireless profile tunnel summary
Profile Name                     AAA-Override AAA-Proxy DHCP Opt82 Enabled 
-------------------------------- ------------ --------- ---------- --------
eogre_tunnel                               No        No        Yes      Yes
eogre_tunnel_set                           No        No        Yes       No
eogre_tunnel_snmp                          No        No         No       No

To view a wireless tunnel profile's details, use this command: 

Device# show wireless profile tunnel detailed profile-name
Profile Name : eogre_tunnel
Status : Enabled
 AAA-Proxy/Accounting-Proxy: Disabled / Disabled
 AAA-Override : Disabled
 DHCP Option82 : Enabled
  Circuit-ID : ap-mac,ap-ethmac,ap-location,vlan
  Remote-ID : ssid-name,ssid-type,client-mac,ap-name
Tunnel Rules
Priority Realm                Vlan Domain (Status/Primary GW/Secondary GW) 
-------- -------------------- ---- ---------------------------------------------
1        *                    2121 eogre_domain (Enabled/Tunnel1/Tunnel2)

To view detailed information about an EoGRE tunnel domain's status, use this command: 

Device# show ap tunnel eogre domain detailed
Domain     : eogre_domain
AP MAC     : 80e8.6fd4.9520
Active GW  : Tunnel1

To view the EoGRE events on an AP, use this command: 

Device# show ap tunnel eogre events
AP 80e8.6fd4.9520  Event history
Timestamp               #Times   Event               RC Context
----------------------- -------- ------------------- -- ----------------------------------------
02/18/2019 23:50:26.341 6        IAPP_STATS           0 GW Tunnel2 uptime:0s                    
02/18/2019 23:49:40.222 2        CLIENT_JOIN          0 74da.3828.88b0, (eogre_domain/2121)     
02/18/2019 23:48:43.549 1        CLIENT_LEAVE         0 74da.3828.88b0, (eogre_domain/2121)     
02/18/2019 23:47:33.127 1        DOMAIN_STATUS        0 eogre_domain Active GW: Tunnel1         
02/18/2019 23:47:33.124 4        AP_TUNNEL_STATUS     0 Tunnel2 Dn                              
02/18/2019 23:47:33.124 1        MSG_CLIENT_DEL       0 GW Tunnel2 (IP: 9.51.1.12)              
02/18/2019 23:47:33.124 2        TUNNEL_ADD           0 GW Tunnel2                              
02/18/2019 23:47:33.120 3        MSG_CLIENT_DEL_PD    0 GW Tunnel1 (IP: 9.51.1.11)              
02/18/2019 23:47:31.763 2        AP_DOMAIN_PUSH       0 Delete:eogre_domain_set, 0 GWs          
02/18/2019 23:47:31.753 4        AP_VAP_PUSH          0 profile:'eogre_tunnel', wlan:pyats_eogre

To view the summary information of the EoGRE tunnel gateway, use this command: 

Device# show ap tunnel eogre gateway summary
AP MAC          Gateway          Type  IP                                      State  Clients
---------------------------------------------------------------------------------------------
80e8.6fd4.9520  Tunnel1          IPv4  9.51.1.11                               Up     1     
80e8.6fd4.9520  Tunnel2          IPv4  9.51.1.12                               Down   0

To view detailed information about an EoGRE tunnel gateway, use this command: 

Device# show ap tunnel eogre gateway detailed gateway-name
Gateway : Tunnel1
 Mode   : IPv4
 IP     : 9.51.1.11
 State  : Up
 MTU    : 1476
 Up Time: 14 hours 25 minutes 2 seconds 
 AP MAC : 80e8.6fd4.9520
 Clients
  Total Number of Wireless Clients      : 1
 Traffic
  Total Number of Received Packets      : 6
  Total Number of Received Bytes        : 2643
  Total Number of Transmitted Packets   : 94
  Total Number of Transmitted Bytes     : 20629
  Total Number of Lost Keepalive        : 3

To view summary information about the EoGRE tunnel gateway status, use this command: 

Device# show ap tunnel eogre domain summary
AP MAC          Domain                           Active Gateway
-------------------------------------------------------------------------------
80e8.6fd4.9520  eogre_domain                     Tunnel1

To view information about EoGRE events on an AP, use this command: 

Device# show ap name ap-name tunnel eogre events
AP 80e8.6fd4.9520  Event history
Timestamp               #Times   Event               RC Context
----------------------- -------- ------------------- -- ----------------------------------------
02/18/2019 23:50:26.341 6        IAPP_STATS           0 GW Tunnel2 uptime:0s                    
02/18/2019 23:49:40.222 2        CLIENT_JOIN          0 74da.3828.88b0, (eogre_domain/2121)     
02/18/2019 23:48:43.549 1        CLIENT_LEAVE         0 74da.3828.88b0, (eogre_domain/2121)     
02/18/2019 23:47:33.127 1        DOMAIN_STATUS        0 eogre_domain Active GW: Tunnel1         
02/18/2019 23:47:33.124 4        AP_TUNNEL_STATUS     0 Tunnel2 Dn                              
02/18/2019 23:47:33.124 1        MSG_CLIENT_DEL       0 GW Tunnel2 (IP: 9.51.1.12)              
02/18/2019 23:47:33.124 2        TUNNEL_ADD           0 GW Tunnel2                              
02/18/2019 23:47:33.120 3        MSG_CLIENT_DEL_PD    0 GW Tunnel1 (IP: 9.51.1.11)              
02/18/2019 23:47:31.763 2        AP_DOMAIN_PUSH       0 Delete:eogre_domain_set, 0 GWs          
02/18/2019 23:47:31.753 4        AP_VAP_PUSH          0 profile:'eogre_tunnel', wlan:pyats_eogre

To view the summary information about EoGRE tunnel domain's status on an AP, use this command: 

Device# show ap name ap-name tunnel eogre domain summary
AP MAC          Domain                           Active Gateway
-------------------------------------------------------------------------------
80e8.6fd4.9520  eogre_domain

To view the detailed information about EoGRE tunnel domain on an AP, use this command: 

Device# show ap name ap-name tunnel eogre domain detailed
Domain Name    : eogre_domain
 Primary GW    : Tunnel1
 Secondary GW  : Tunnel2
 Active GW     : Tunnel1
 Redundancy    : Non-Revertive
 AdminState    : Up

To view the summary information about EoGRE tunnel gateways on an AP, use this command: 

Device# show ap name ap-name tunnel eogre gateway summary
AP MAC          Gateway          Type  IP                                      State  Clients
---------------------------------------------------------------------------------------------
80e8.6fd4.9520  Tunnel1          IPv4  9.51.1.11                               Up     1     
80e8.6fd4.9520  Tunnel2          IPv4  9.51.1.12                               Down   0

To view detailed information about an EoGRE tunnel gateway's status on an AP, use this command: 

Device# show ap name ap-name tunnel eogre gateway detailed gateway-name
Gateway : Tunnel2
 Mode   : IPv4
 IP     : 9.51.1.12
 State  : Down
 MTU    : 0
 AP MAC : 80e8.6fd4.9520
 Clients
  Total Number of Wireless Clients      : 0
 Traffic
  Total Number of Received Packets      : 0
  Total Number of Received Bytes        : 0
  Total Number of Transmitted Packets   : 0
  Total Number of Transmitted Bytes     : 0
  Total Number of Lost Keepalive        : 151