排除SD-WAN动态按需隧道故障

已更新: 2023 年 10 月 5 日

文档 ID:221045

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍在配置或检查与SD-WAN动态按需隧道相关的问题时可以使用的故障排除命令。

前提条件

使用的组件

本文档基于以下配置参考、软件和硬件版本：

vManage 20.9.3版
边缘路由器ISR4K版本17.9.3
所有设备都配置为根据官方文档建立动态按需隧道

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

注：请参阅本文档了解动态按需隧道配置。

背景信息

Cisco SD-WAN支持任意两个Cisco SD-WAN分支设备之间的动态按需隧道。仅当两台设备之间存在流量时，才会触发这些隧道进行设置，从而优化带宽使用率和设备性能。

工作场景

使用的拓扑

在正常操作情况下，按需隧道触发条件如下：

无法建立分支之间的BFD会话，甚至在show sdwan bfd sessions中显示为down
在终端之间发送关注流量时，可以触发BFD会话
必须设置和确认基本动态按需隧道配置

触发按需隧道激活

在初始阶段，分支之间的BFD会话未启动，只有从分支到中心的会话处于启动状态，并且按需系统状态在分支和OMP表中均显示为非活动状态，从中心备份路由设置为C、I、R，而从分支2的路由设置为I、U、IA

Spoke 1#show sdwan bfd sessions 
                            SOURCE TLOC REMOTE TLOC             DST PUBLIC    DST PUBLIC         DETECT TX
SYSTEM IP     SITE ID STATE COLOR       COLOR       SOURCE IP   IP            PORT         ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100  100     up    blue        blue        10.10.10.1  10.100.100.1  12366        ipsec     7       1000          2:13:14:35 6

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP   ON-DEMAND STATUS   IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2  yes       inactive  - 

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                               AFFINITY 
                                         PATH                 ATTRIBUTE                                        GROUP 
TENANT    VPN       PREFIX      FROM PEER  ID LABEL STATUS    TYPE     TLOC IP      COLOR     ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0         10       10.2.2.2/32 192.168.0.1 61 1005   C,I,R   installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.1 62 1003   I,U,IA  installed 10.10.10.2   default   ipsec  -     None    None - 
                               192.168.0.1 64 1005   C,R     installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.1 65 1003   I,U,IA  installed 10.10.10.2   private1  ipsec  -     None    None - 
                               192.168.0.1 67 1005   Inv,U   installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.1 68 1003   I,U,IA  installed 10.10.10.2   private2  ipsec  -     None    None - 
                               192.168.0.2 71 1005   C,R     installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.2 72 1003   U,IA    installed 10.10.10.2   default   ipsec  -     None    None - 
                               192.168.0.2 74 1005   C,R     installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.2 75 1003   U,IA    installed 10.10.10.2   private1  ipsec  -     None    None - 
                               192.168.0.2 77 1005   Inv,U   installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.2 78 1003   U,IA    installed 10.10.10.2   private2  ipsec  -     None    None -
 
Spoke 2#show sdwan bfd sessions 
                            SOURCE TLOC REMOTE TLOC              DST PUBLIC    DST PUBLIC          DETECT TX
SYSTEM IP     SITE ID STATE COLOR       COLOR        SOURCE IP   IP            PORT         ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100   100    up     blue        blue        10.10.10.2 10.100.100.1    12366       ipsec     7        1000        0:11:10:01 1

Spoke 2#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP  ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1       10.10.10.1 yes       inactive -

要触发按需隧道激活，需要关注流量。在本示例中，使用ICMP流量，在发送流量后，按需远程系统的状态从两端的inactive状态更改为active状态，OMP表中的目标前缀从C、I、R状态从Hub更改为C、I、R状态（从Spoke 2）

Spoke 1#ping vrf 10 10.2.2.2 re 20
Type escape sequence to abort.
Sending 20, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (20/20), round-trip min/avg/max = 1/3/31 ms

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP   ON-DEMAND   STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2  yes         active 56

Spoke 1#show sdwan bfd sessions 
                            SOURCE TLOC REMOTE TLOC            DST PUBLIC   DST PUBLIC       DETECT TX
SYSTEM IP     SITE ID STATE COLOR       COLOR     SOURCE IP    IP           PORT       ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100   100     up blue          blue      10.10.10.1   10.100.100.1 12366      ipsec    7        1000 0:11:14:51 1
10.10.10.2     2       up default       default   10.10.10.1   10.12.12.2   12366      ipsec    7        1000 0:00:00:53 1----> BFD session established due of interest traffic and on-demand configuration
10.10.10.2     2       up blue          blue      10.10.10.1   10.12.12.2   12366      ipsec    7        1000 0:00:00:52 1

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                                 AFFINITY 
                                   PATH                    ATTRIBUTE                                             GROUP 
TENANT   VPN PREFIX      FROM PEER  ID LABEL STATUS         TYPE      TLOC IP     COLOR         ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0        10 10.2.2.2/32 192.168.0.1 61 1005     R          installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.1 62 1003     C,I,R      installed 10.10.10.2    default      ipsec   -     None      None - 
                        192.168.0.1 64 1005     R          installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.1 65 1003     C,I,R      installed 10.10.10.2    private1     ipsec   -     None      None - 
                        192.168.0.1 67 1005     Inv,U      installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.1 68 1003     C,I,R      installed 10.10.10.2    private2     ipsec   -     None      None - 
                        192.168.0.2 71 1005     R          installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.2 72 1003     C,R        installed 10.10.10.2    default      ipsec   -     None      None - 
                        192.168.0.2 74 1005     R          installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.2 75 1003     C,R        installed 10.10.10.2    private1     ipsec   -     None      None - 
                        192.168.0.2 77 1005     Inv,U      installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.2 78 1003     C,R        installed 10.10.10.2    private2     ipsec   -     None      None -

Spoke 2#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND    STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1      10.10.10.1 yes         active 53 

Spoke 2#show sdwan bfd sessions 
                           SOURCE TLOC  REMOTE TLOC              DST PUBLIC    DST PUBLIC       DETECT TX
SYSTEM IP    SITE ID STATE COLOR        COLOR     SOURCE IP      IP            PORT     ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100  100     up   blue          blue    10.10.10.2      10.100.100.1  12366    ipsec    7          1000 0:11:14:56 1
10.10.10.1    2       up   default       default 10.10.10.2      10.11.11.1    12366    ipsec    7          1000 0:00:00:53 1----> BFD session established due of interest traffic and on-demand configuration
10.10.10.1    2       up   blue          blue    10.10.10.2      10.11.11.1    12366    ipsec    7          1000 0:00:00:52

当空闲流量停止且空闲超时过期后，分支之间的BFD会话消失，按需状态返回非活动状态，路由从OMP表中的集线器返回到C、I、R备份路由状态

Spoke 1#show sdwan bfd sessions 
                             SOURCE TLOC REMOTE TLOC               DST PUBLIC     DST PUBLIC     DETECT TX
SYSTEM IP     SITE ID STATE   COLOR        COLOR    SOURCE IP      IP              PORT    ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100  100      up     blue         blue     10.10.10.1      10.100.100.1   12366   ipsec   7           1000 0:11:19:11 1

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2      10.10.10.2  yes      inactive - 

Spoke 2#show sdwan bfd sessions 
                              SOURCE TLOC REMOTE TLOC              DST PUBLIC       DST PUBLIC    DETECT TX
SYSTEM IP     SITE ID   STATE COLOR         COLOR   SOURCE IP       IP               PORT   ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100  100       up    blue          blue    10.10.10.2      10.100.100.1    12366   ipsec  7            1000 0:11:19:11 1

Spoke 2#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1 10.10.10.1 yes inactive -

常见问题场景

使用的拓扑

Topology Used

场景1：分支认为通过集线器的备份路径无效且无法解析

症状

无法到达分支2的目标前缀，发现来自集线器的备份路径，但认为该路径无效/已卸载

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                         AFFINITY 
                                    PATH                  ATTRIBUTE                                      GROUP 
TENANT VPN PREFIX      FROM PEER    ID      LABEL  STATUS TYPE       TLOC IP    COLOR   ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0     10   10.2.2.2/32 192.168.0.1  61  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.1  62  1003       U,IA  installed 10.10.10.2   default ipsec   -          None     None - 
                       192.168.0.1  64  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.1  65  1003       U,IA  installed 10.10.10.2   private1ipsec   -          None     None - 
                       192.168.0.1  67  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.1  68  1003       U,IA  installed 10.10.10.2   private2ipsec   -          None     None - 
                       192.168.0.2  71  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.2  72  1003       U,IA  installed 10.10.10.2   default ipsec   -          None     None - 
                       192.168.0.2  74  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.2  75  1003       U,IA  installed 10.10.10.2   private1ipsec   -          None     None - 
                       192.168.0.2  77  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.2  78  1003       U,IA  installed 10.10.10.2   private2ipsec   -          None     None -

故障排除

检查是否建立了指向分支的集线器BFD会话

Hub#show sdwan bfd sessions 
                          SOURCE TLOC    REMOTE TLOC                    DST PUBLIC DST PUBLIC       DETECT     TX
SYSTEM IP  SITE ID  STATE COLOR          COLOR.          SOURCE IP      IP         PORT       ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.2  2       up   blue           blue             10.10.10.100   10.12.12.2 12366      ipsec 7          1000         1:23:58:15  2
10.10.10.1  1       up   default        default          10.10.10.100   10.11.11.1 12366      ipsec 7          1000         1:23:59:12  6

检查按需隧道策略，确认所有站点根据其角色（中心或分支）包括在正确的站点列表中

使用show sdwan system on-demand命令确认分支中是否启用了按需功能，以及是否处于活动状态

Spoke 1#show sdwan system on-demand 
SITE-ID SYSTEM-IP  ON-DEMAND STATUS IDLE-TIMEOUT-CFG(min)
-------------------------------------------------------------------------
1       10.10.10.1 yes       active 10

Spoke 2#show sdwan system on-demand 
SITE-ID SYSTEM-IP  ON-DEMAND STATUS IDLE-TIMEOUT-CFG(min)
-------------------------------------------------------------------------
2       10.10.10.2 yes       active 10

确认中心站点中是否启用了流量工程服务（服务TE）。有用的命令可以 show sdwan run | inc TE

hub#show sdwan run | inc TE
!

解决方案

在这种情况下，中心站点中未启用服务TE。要修复，请在中心端配置它：

hub#config-trans
hub(config)# sdwan
hub(config-vrf-global)# service TE vrf global
hub(config-vrf-global)# commit

检查分支1 OMP表中的路由是否已更改，现在将此路由设置为C、I、R，表示来自中心10.10.100的条目（生成兴趣流量之前），而来自Spoke 2 10.10.10.2的条目，则设置为C、I、R（生成兴趣流量）。此外，使用命令show sdwan system on-demand remote-system <remote system ip>，检查分支1和分支2之间的BFD会话，并且按需隧道处于启用状态：

Before interest traffic

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

AFFINITY 
                                   PATH               ATTRIBUTE GROUP 
TENANT   VPN PREFIX      FROM PEER ID LABEL STATUS    TYPE     TLOC IP        COLOR      ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0        10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R    installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.1 62 1003 I,U,IA   installed 10.10.10.2     default    ipsec   -          None None - 
                        192.168.0.1 64 1005 C,R      installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.1 65 1003 I,U,IA   installed 10.10.10.2     private1   ipsec   -          None None - 
                        192.168.0.1 67 1005 Inv,U    installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.1 68 1003 I,U,IA   installed 10.10.10.2     private2   ipsec   -          None None - 
                        192.168.0.2 71 1005 C,R      installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.2 72 1003 U,IA     installed 10.10.10.2     default    ipsec   -          None None - 
                        192.168.0.2 74 1005 C,R      installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.2 75 1003 U,IA     installed 10.10.10.2     private1   ipsec   -          None None - 
                        192.168.0.2 77 1005 Inv,U    installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.2 78 1003 U,IA     installed 10.10.10.2     private2   ipsec   -          None None -

While interest traffic

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                            AFFINITY 
                                  PATH             ATTRIBUTE                                GROUP 
TENANT VPN PREFIX      FROM PEER  ID LABEL STATUS  TYPE      TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10 10.2.2.2/32 192.168.0.1 61 1005 R        installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.1 62 1003 C,I,R    installed 10.10.10.2     default       ipsec - None None - 
                      192.168.0.1 64 1005 R        installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.1 65 1003 C,I,R    installed 10.10.10.2     private1      ipsec - None None - 
                      192.168.0.1 67 1005 Inv,U    installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.1 68 1003 C,I,R    installed 10.10.10.2     private2      ipsec - None None - 
                      192.168.0.2 71 1005 R        installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.2 72 1003 C,R      installed 10.10.10.2     default       ipsec - None None - 
                      192.168.0.2 74 1005 R        installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.2 75 1003 C,R      installed 10.10.10.2     private1      ipsec - None None - 
                      192.168.0.2 77 1005 Inv,U    installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.2 78 1003 C,R      installed 10.10.10.2     private2      ipsec - None None -

Spoke 1#show sdwan bfd sessions 
                                      SOURCE TLOC REMOTE TLOC            DST PUBLIC      DST PUBLIC      DETECT TX
SYSTEM IP         SITE ID    STATE     COLOR       COLOR   SOURCE IP      IP              PORT    ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100       100         up      blue        blue    10.10.10.1     10.100.100.1    12366   ipsec    7        1000     1:23:58:15 2
10.10.10.2         2           up      default     default 10.10.10.1     10.12.12.2      12366   ipsec    7        1000     0:00:01:50 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2         2           up      blue        blue    10.10.10.1     10.12.12.2      12366   ipsec    7        1000     0:00:01:52 2

Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2 yes      active  41 ------>on-demand tunnel established to spoke 2 10.10.10.2 due of interest traffic

方案 2：分支之间的BFD会话保持开启

症状

在这种情况下，使用命令show sdwan system on-demand remote-system在按需远程终端中列出远程Spoke 2终端，其状态为no on-demand，即使没有发送任何感兴趣的流量，并且直接从Spoke 2获取目标前缀，Spoke 1和Spoke 2之间的BFD会话仍保持活动状态

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2 no        -     - 

Spoke 1#show sdwan bfd sessions 
                           SOURCE TLOC REMOTE TLOC           DST PUBLIC   DST PUBLIC       DETECT TX
SYSTEM IP    SITE ID STATE COLOR       COLOR      SOURCE IP  IP           PORT       ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100      up   blue        blue       10.10.10.1 10.100.100.1 12366      ipsec 7           1000 1:23:58:15 3
10.10.10.2   2        up   default     default    10.10.10.1 10.12.12.2   12366      ipsec 7           1000 0:00:18:53 4
10.10.10.2   2        up   blue        blue       10.10.10.1 10.12.12.2   12366      ipsec 7           1000 0:00:18:52 3

Spoke 1#show sdwan omp route vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                          AFFINITY 
                                     PATH              ATTRIBUTE                                          GROUP 
TENANT VPN PREFIX          FROM PEER ID LABEL STATUS   TYPE      TLOC IP      COLOR      ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10 10.2.2.2/32     192.168.0.1 73 1005 R        installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.1 74 1003 C,I,R    installed 10.10.10.2    default   ipsec  -          None       None      -  
                          192.168.0.1 76 1005 R        installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.1 77 1003 C,I,R    installed 10.10.10.2    private1  ipsec  -          None       None      - 
                          192.168.0.1 79 1005 Inv,U    installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.1 80 1003 C,I,R    installed 10.10.10.2    private2  ipsec  -          None       None      - 
                          192.168.0.2 89 1005 R        installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.2 90 1003 C,R      installed 10.10.10.2    default   ipsec  -          None       None      - 
                          192.168.0.2 92 1005 R        installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.2 93 1003 C,R      installed 10.10.10.2    private1  ipsec  -          None       None      - 
                          192.168.0.2 95 1005 Inv,U    installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.2 96 1003 C,R      installed 10.10.10.2    private2  ipsec  -          None       None      -

故障排除

检查按需隧道策略，确认所有站点根据其角色（中心或分支）包括在正确的站点列表中

viptela-policy:policy
 control-policy ondemand
    sequence 1
     match route
      site-list Spokes
      prefix-list _AnyIpv4PrefixList
     !
     action accept
      set
       tloc-action backup
       tloc-list hub
      !
     !
    !
  default-action accept
 !
 lists
  site-list Spokes
   site-id 1-2 
  !
  tloc-list hub
   tloc 10.10.10.100 color blue encap ipsec 
   tloc 10.10.10.100 color default encap ipsec 
   tloc 10.10.10.100 color private1 encap ipsec 
   tloc 10.10.10.100 color private2 encap ipsec 
  !
  prefix-list _AnyIpv4PrefixList
   ip-prefix 0.0.0.0/0 le 32 
  !
 !
!
apply-policy
 site-list Spokes
  control-policy ondemand out
 !
!

使用show sdwan run命令检查是否启用按需模式 | 在辐射点和TE中的inc on-demand使用命令show sdwan run在集线器中启用 | inc TE

Spoke 1#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10

Spoke 2#show sdwan run | inc on-demand
Spoke 2#

Hub#show sdwan run | inc TE
service TE vrf global

解决方案

在这种情况下，分支2中未启用按需模式。要修复，请在“分支2”端配置它

Spoke 2#config-trans
Spoke 2(config)# system
Spoke 2(config-vrf-global)# on-demand enable
Spoke 2(config-vrf-global)# on-demand idle-timeout 10
Spoke 2(config-vrf-global)# commit

检查分支1中现在分支2是否被视为按需是，且OMP表已更改，并且现在对于来自中心10.10.10.100（生成兴趣流量之前）而不是直接来自分支2的条目将此路由设置为C、I、R

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2 yes inactive - 

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

AFFINITY 
        PATH ATTRIBUTE GROUP 
TENANT VPN PREFIX       FROM PEER   ID LABEL STATUS TYPE     TLOC IP      COLOR       ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10  10.2.2.2/32  192.168.0.1 61 1005 C,I,R  installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.1 62 1003 I,U,IA installed 10.10.10.2    default    ipsec      -        None    None - 
                        192.168.0.1 64 1005 C,R    installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.1 65 1003 I,U,IA installed 10.10.10.2    private1   ipsec      -        None    None - 
                        192.168.0.1 67 1005 Inv,U  installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.1 68 1003 I,U,IA installed 10.10.10.2    private2   ipsec      -        None    None - 
                        192.168.0.2 71 1005 C,R    installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.2 72 1003 U,IA   installed 10.10.10.2    default    ipsec      -        None    None - 
                        192.168.0.2 74 1005 C,R    installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.2 75 1003 U,IA   installed 10.10.10.2    private1   ipsec      -        None    None - 
                        192.168.0.2 77 1005 Inv,U  installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.2 78 1003 U,IA   installed 10.10.10.2    private2   ipsec      -        None    None -

当生成兴趣流量时，来自Spoke 2 10.10.10.2的条目会获得C、I、R。此外，检查分支1和分支2之间的BFD会话是否已启动，并且使用命令检查按需隧道是否已启动 show sdwan system on-demand remote-system <remote system ip>

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                                AFFINITY 
                                               PATH               ATTRIBUTE                                     GROUP 
TENANT  VPN        PREFIX          FROM PEER   ID LABEL STATUS    TYPE     TLOC IP      COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0       10         10.2.2.2/32     192.168.0.1 61 1005 R         installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.1 62 1003 C,I,R     installed 10.10.10.2    default  ipsec   - None None - 
                                   192.168.0.1 64 1005 R         installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.1 65 1003 C,I,R     installed 10.10.10.2    private1 ipsec   - None None - 
                                   192.168.0.1 67 1005 Inv,U     installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.1 68 1003 C,I,R     installed 10.10.10.2    private2 ipsec   - None None - 
                                   192.168.0.2 71 1005 R         installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.2 72 1003 C,R       installed 10.10.10.2    default  ipsec   - None None - 
                                   192.168.0.2 74 1005 R         installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.2 75 1003 C,R       installed 10.10.10.2    private1 ipsec   - None None - 
                                   192.168.0.2 77 1005 Inv,U     installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.2 78 1003 C,R       installed 10.10.10.2    private2 ipsec   - None None -

Spoke 1#show sdwan bfd sessions 
                        SOURCE TLOC REMOTE TLOC             DST PUBLIC  DST PUBLIC          DETECT      TX
SYSTEM IP SITE ID STATE COLOR       COLOR       SOURCE IP   IP          PORT         ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100  up blue          blue         10.10.10.1 10.100.100.1 12366       ipsec     7        1000 2:04:34:11 2
10.10.10.2   2    up default       default      10.10.10.1 10.12.12.2   12366       ipsec     7        1000 0:00:02:10 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2   2    up blue          blue         10.10.10.1 10.12.12.2   12366       ipsec     7        1000 0:00:02:08 2

Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2        10.10.10.2 yes      active   41 ------>on-demand tunnel established to Spoke 2 10.10.10.2 due of interest traffic

场景3：没有从集线器的备份路由租赁或安装在分支中

症状

在这种情况下，在OMP表中没有源自Spoke 2的前缀10.2.2.2/32的备份路由，只能看到按需非活动条目。已确认已配置分支中的按需和集线器中的TE

Spoke 1#show sdwan omp route vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

AFFINITY 
PATH ATTRIBUTE GROUP 
TENANT VPN      PREFIX     FROM PEER   ID LABEL STATUS TYPE     TLOC IP   COLOR   ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10      10.2.2.2/32 192.168.0.1 108 1003 U,IA installed 10.10.10.2 default  ipsec -             None  None - 
                           192.168.0.1 113 1003 U,IA installed 10.10.10.2 private1 ipsec -             None  None - 
                           192.168.0.1 141 1003 U,IA installed 10.10.10.2 private2 ipsec -             None  None - 
                           192.168.0.2 112 1003 U,IA installed 10.10.10.2 default  ipsec -             None  None - 
                           192.168.0.2 117 1003 U,IA installed 10.10.10.2 private1 ipsec -             None  None - 
                           192.168.0.2 144 1003 U,IA installed 10.10.10.2 private2 ipsec -             None  None - 



Spoke 1#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10

Spoke 2#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10

Hub#show sdwan run | inc TE
service TE vrf global

故障排除

检查按需集中策略，并确认是否所有辐射点都包含在正确的站点列表中

viptela-policy:policy
 control-policy ondemand
    sequence 1
     match route
      site-list Spokes
      prefix-list _AnyIpv4PrefixList
     !
     action accept
      set
       tloc-action backup
       tloc-list hub
      !
     !
    !
  default-action accept
 !
 lists
  site-list Spokes
   site-id 1 
  !
  tloc-list hub
   tloc 10.10.10.100 color blue encap ipsec 
   tloc 10.10.10.100 color default encap ipsec 
   tloc 10.10.10.100 color private1 encap ipsec 
   tloc 10.10.10.100 color private2 encap ipsec 
  !
  prefix-list _AnyIpv4PrefixList
   ip-prefix 0.0.0.0/0 le 32 
  !
 !
!
apply-policy
 site-list Spokes
  control-policy ondemand out
 !

解决方案

请注意，策略中的站点列表辐条中缺少Spoke 2站点ID 2。在将其包含在站点列表中后，备用路径安装正确，当发送关注流量时，会启动按需隧道和分支之间的BFD会话。

Spokes site list from policy before
lists 
site-list Spokes 
site-id 1 
!

Spokes site list from policy after
lists
site-list Spokes 
site-id 1-2
!

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

AFFINITY 
PATH ATTRIBUTE GROUP 
TENANT VPN PREFIX           FROM PEER   ID LABEL STATUS TYPE      TLOC IP      COLOR    ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10  10.2.2.2/32      192.168.0.1 61 1005 C,I,R   installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.1 62 1003 I,U,IA  installed 10.10.10.2   default  ipsec    -        None     None - 
                            192.168.0.1 64 1005 C,R     installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.1 65 1003 I,U,IA  installed 10.10.10.2   private1 ipsec    -        None     None - 
                            192.168.0.1 67 1005 Inv,U   installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.1 68 1003 I,U,IA  installed 10.10.10.2   private2 ipsec    -        None     None - 
                            192.168.0.2 71 1005 C,R     installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.2 72 1003 U,IA    installed 10.10.10.2   default  ipsec    -        None     None - 
                            192.168.0.2 74 1005 C,R     installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.2 75 1003 U,IA    installed 10.10.10.2   private1 ipsec    -        None     None - 
                            192.168.0.2 77 1005 Inv,U   installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.2 78 1003 U,IA    installed 10.10.10.2   private2 ipsec    -        None     None -

Spoke 1#show sdwan bfd sessions 
SOURCE                     TLOC REMOTE TLOC DST PUBLIC     DST PUBLIC              DETECT        TX
SYSTEM IP    SITE ID STATE COLOR       COLOR    SOURCE IP  IP           PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100   100   up    blue         blue    10.10.10.1 10.100.100.1 12366 ipsec  7          1000         2:07:01:43 6
10.10.10.2      2    up    default      default 10.10.10.1 10.12.12.2   12366 ipsec  7          1000         0:00:00:56 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2      2    up    blue         blue    10.10.10.1 10.12.12.2   12366 ipsec  7          1000         0:00:00:56 2

Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2 yes      active    56 ------>on-demand tunnel established to Spoke 2 10.10.10.2 due of interest traffic

有用的命令

show sdwan system on-demand
show sdwan system on-demand remote-system
show sdwan system on-demand remote-system system-ip <system ip>
show sdwan run | inc按需
show sdwan run | inc TE
show sdwan ompo routes vpn <vpn number>

修订历史记录

版本	发布日期	备注
1.0	05-Oct-2023	初始版本

由思科工程师提供

Daniel Alva Vargas
技术咨询工程师

此文档是否有帮助?

反馈

联系我们

提交支持案例
(需要思科服务合同)

排除SD-WAN动态按需隧道故障

非歧视性语言

关于此翻译

目录

简介

前提条件

使用的组件

背景信息

工作场景

使用的拓扑

触发按需隧道激活

常见问题场景

使用的拓扑

场景1：分支认为通过集线器的备份路径无效且无法解析

症状

故障排除

解决方案

方案 2：分支之间的BFD会话保持开启

症状

故障排除

解决方案

场景3：没有从集线器的备份路由租赁或安装在分支中

症状

故障排除

解决方案

有用的命令

修订历史记录

由思科工程师提供

此文档是否有帮助?

联系我们

本文档适用于以下产品

排除SD-WAN动态按需隧道故障

非歧视性语言

关于此翻译

目录

简介

前提条件

使用的组件

背景信息

工作场景

使用的拓扑

触发按需隧道激活

常见问题场景

使用的拓扑

场景1：分支认为通过集线器的备份路径无效且无法解析

症状

故障排除

解决方案

方案 2： 分支之间的BFD会话保持开启

症状

故障排除

解决方案

场景3：没有从集线器的备份路由租赁或安装在分支中

症状

故障排除

解决方案

有用的命令

修订历史记录

由思科工程师提供

此文档是否有帮助?

联系我们

本文档适用于以下产品

方案 2：分支之间的BFD会话保持开启