SD-WAN動態按需隧道故障排除

已更新: 2023 年 10 月 5 日

文件 ID:221045

無偏見用語

本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。

關於此翻譯

思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。

簡介

本文檔介紹在配置或檢查與SD-WAN動態按需隧道相關的問題時可以使用的故障排除命令。

必備條件

採用元件

本檔案以以下組態參考、軟體和硬體版本為基礎：

vManage版本20.9.3
邊緣路由器ISR4K版本17.9.3
所有裝置均配置為根據官方文檔建立動態按需隧道

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

註：有關動態按需隧道配置，請參閱本文檔。

背景資訊

Cisco SD-WAN支援任意兩個Cisco SD-WAN分支裝置之間的動態隨需隧道。僅當兩台裝置之間存在流量最佳化頻寬使用率和裝置效能時，才會觸發這些隧道的設定。

工作場景

使用的拓撲

在正常操作場景中，按需隧道觸發條件為：

輻條之間的BFD會話無法建立，甚至在show sdwan bfd sessions中顯示為關閉
在終端之間傳送關注流量時，可以觸發BFD會話
必須設定和確認基本動態按需隧道配置

Triger按需通道啟用

最初輪輻之間的BFD會話未啟動，只有從輪輻到集線器的會話處於啟動狀態，並且按需系統狀態在輪輻和OMP表中均可視為非活動狀態，從集線器的備份路由設定為C、I、R，而從輪輻2的路由設定為I、U、IA

Spoke 1#show sdwan bfd sessions 
                            SOURCE TLOC REMOTE TLOC             DST PUBLIC    DST PUBLIC         DETECT TX
SYSTEM IP     SITE ID STATE COLOR       COLOR       SOURCE IP   IP            PORT         ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100  100     up    blue        blue        10.10.10.1  10.100.100.1  12366        ipsec     7       1000          2:13:14:35 6

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP   ON-DEMAND STATUS   IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2  yes       inactive  - 

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                               AFFINITY 
                                         PATH                 ATTRIBUTE                                        GROUP 
TENANT    VPN       PREFIX      FROM PEER  ID LABEL STATUS    TYPE     TLOC IP      COLOR     ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0         10       10.2.2.2/32 192.168.0.1 61 1005   C,I,R   installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.1 62 1003   I,U,IA  installed 10.10.10.2   default   ipsec  -     None    None - 
                               192.168.0.1 64 1005   C,R     installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.1 65 1003   I,U,IA  installed 10.10.10.2   private1  ipsec  -     None    None - 
                               192.168.0.1 67 1005   Inv,U   installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.1 68 1003   I,U,IA  installed 10.10.10.2   private2  ipsec  -     None    None - 
                               192.168.0.2 71 1005   C,R     installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.2 72 1003   U,IA    installed 10.10.10.2   default   ipsec  -     None    None - 
                               192.168.0.2 74 1005   C,R     installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.2 75 1003   U,IA    installed 10.10.10.2   private1  ipsec  -     None    None - 
                               192.168.0.2 77 1005   Inv,U   installed 10.10.10.100 blue      ipsec  -     None    None - 
                               192.168.0.2 78 1003   U,IA    installed 10.10.10.2   private2  ipsec  -     None    None -
 
Spoke 2#show sdwan bfd sessions 
                            SOURCE TLOC REMOTE TLOC              DST PUBLIC    DST PUBLIC          DETECT TX
SYSTEM IP     SITE ID STATE COLOR       COLOR        SOURCE IP   IP            PORT         ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100   100    up     blue        blue        10.10.10.2 10.100.100.1    12366       ipsec     7        1000        0:11:10:01 1

Spoke 2#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP  ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1       10.10.10.1 yes       inactive -

要觸發按需隧道啟用，需要關注流量。在此示例中，使用ICMP流量，傳送流量後，按需遠端系統的狀態從兩端的「非活動」狀態更改為「活動」狀態，OMP表中的目標字首從「中心」狀態更改為「分支2」狀態的「C，I，R」狀態

Spoke 1#ping vrf 10 10.2.2.2 re 20
Type escape sequence to abort.
Sending 20, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (20/20), round-trip min/avg/max = 1/3/31 ms

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP   ON-DEMAND   STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2  yes         active 56

Spoke 1#show sdwan bfd sessions 
                            SOURCE TLOC REMOTE TLOC            DST PUBLIC   DST PUBLIC       DETECT TX
SYSTEM IP     SITE ID STATE COLOR       COLOR     SOURCE IP    IP           PORT       ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100   100     up blue          blue      10.10.10.1   10.100.100.1 12366      ipsec    7        1000 0:11:14:51 1
10.10.10.2     2       up default       default   10.10.10.1   10.12.12.2   12366      ipsec    7        1000 0:00:00:53 1----> BFD session established due of interest traffic and on-demand configuration
10.10.10.2     2       up blue          blue      10.10.10.1   10.12.12.2   12366      ipsec    7        1000 0:00:00:52 1

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                                 AFFINITY 
                                   PATH                    ATTRIBUTE                                             GROUP 
TENANT   VPN PREFIX      FROM PEER  ID LABEL STATUS         TYPE      TLOC IP     COLOR         ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0        10 10.2.2.2/32 192.168.0.1 61 1005     R          installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.1 62 1003     C,I,R      installed 10.10.10.2    default      ipsec   -     None      None - 
                        192.168.0.1 64 1005     R          installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.1 65 1003     C,I,R      installed 10.10.10.2    private1     ipsec   -     None      None - 
                        192.168.0.1 67 1005     Inv,U      installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.1 68 1003     C,I,R      installed 10.10.10.2    private2     ipsec   -     None      None - 
                        192.168.0.2 71 1005     R          installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.2 72 1003     C,R        installed 10.10.10.2    default      ipsec   -     None      None - 
                        192.168.0.2 74 1005     R          installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.2 75 1003     C,R        installed 10.10.10.2    private1     ipsec   -     None      None - 
                        192.168.0.2 77 1005     Inv,U      installed 10.10.10.100  blue         ipsec   -     None      None - 
                        192.168.0.2 78 1003     C,R        installed 10.10.10.2    private2     ipsec   -     None      None -

Spoke 2#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND    STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1      10.10.10.1 yes         active 53 

Spoke 2#show sdwan bfd sessions 
                           SOURCE TLOC  REMOTE TLOC              DST PUBLIC    DST PUBLIC       DETECT TX
SYSTEM IP    SITE ID STATE COLOR        COLOR     SOURCE IP      IP            PORT     ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100  100     up   blue          blue    10.10.10.2      10.100.100.1  12366    ipsec    7          1000 0:11:14:56 1
10.10.10.1    2       up   default       default 10.10.10.2      10.11.11.1    12366    ipsec    7          1000 0:00:00:53 1----> BFD session established due of interest traffic and on-demand configuration
10.10.10.1    2       up   blue          blue    10.10.10.2      10.11.11.1    12366    ipsec    7          1000 0:00:00:52

在暫停流量停止和空閒超時過期後，分支之間的BFD會話消失，按需狀態返回到非活動，路由從OMP表中的集線器返回到備份路由狀態C、I、R

Spoke 1#show sdwan bfd sessions 
                             SOURCE TLOC REMOTE TLOC               DST PUBLIC     DST PUBLIC     DETECT TX
SYSTEM IP     SITE ID STATE   COLOR        COLOR    SOURCE IP      IP              PORT    ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100  100      up     blue         blue     10.10.10.1      10.100.100.1   12366   ipsec   7           1000 0:11:19:11 1

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2      10.10.10.2  yes      inactive - 

Spoke 2#show sdwan bfd sessions 
                              SOURCE TLOC REMOTE TLOC              DST PUBLIC       DST PUBLIC    DETECT TX
SYSTEM IP     SITE ID   STATE COLOR         COLOR   SOURCE IP       IP               PORT   ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100  100       up    blue          blue    10.10.10.2      10.100.100.1    12366   ipsec  7            1000 0:11:19:11 1

Spoke 2#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1 10.10.10.1 yes inactive -

常見問題場景

使用的拓撲

Topology Used

場景1：通過輻條認為無效且無法解析的集線器的備份路徑

症狀

無法到達分支2的目標字首，發現來自集線器的備份路徑，但認為該路徑無效/已解除安裝

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                         AFFINITY 
                                    PATH                  ATTRIBUTE                                      GROUP 
TENANT VPN PREFIX      FROM PEER    ID      LABEL  STATUS TYPE       TLOC IP    COLOR   ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0     10   10.2.2.2/32 192.168.0.1  61  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.1  62  1003       U,IA  installed 10.10.10.2   default ipsec   -          None     None - 
                       192.168.0.1  64  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.1  65  1003       U,IA  installed 10.10.10.2   private1ipsec   -          None     None - 
                       192.168.0.1  67  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.1  68  1003       U,IA  installed 10.10.10.2   private2ipsec   -          None     None - 
                       192.168.0.2  71  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.2  72  1003       U,IA  installed 10.10.10.2   default ipsec   -          None     None - 
                       192.168.0.2  74  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.2  75  1003       U,IA  installed 10.10.10.2   private1ipsec   -          None     None - 
                       192.168.0.2  77  1005       Inv,U installed 10.10.10.100 blue    ipsec   -          None     None - 
                       192.168.0.2  78  1003       U,IA  installed 10.10.10.2   private2ipsec   -          None     None -

疑難排解

檢查是否建立了指向輻條的集線器BFD會話

Hub#show sdwan bfd sessions 
                          SOURCE TLOC    REMOTE TLOC                    DST PUBLIC DST PUBLIC       DETECT     TX
SYSTEM IP  SITE ID  STATE COLOR          COLOR.          SOURCE IP      IP         PORT       ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.2  2       up   blue           blue             10.10.10.100   10.12.12.2 12366      ipsec 7          1000         1:23:58:15  2
10.10.10.1  1       up   default        default          10.10.10.100   10.11.11.1 12366      ipsec 7          1000         1:23:59:12  6

檢查按需隧道策略，確認所有站點都根據其角色（中心或分支）包括在正確的站點清單中

使用命令show sdwan system on-demand確認輪輻中是否啟用並啟用了按需功能

Spoke 1#show sdwan system on-demand 
SITE-ID SYSTEM-IP  ON-DEMAND STATUS IDLE-TIMEOUT-CFG(min)
-------------------------------------------------------------------------
1       10.10.10.1 yes       active 10

Spoke 2#show sdwan system on-demand 
SITE-ID SYSTEM-IP  ON-DEMAND STATUS IDLE-TIMEOUT-CFG(min)
-------------------------------------------------------------------------
2       10.10.10.2 yes       active 10

確認中心站點中是否已啟用流量工程服務（服務TE）。有用的命令可以 show sdwan run | 包括TE

hub#show sdwan run | inc TE
!

解決方案

在這種情況下，中心站點中未啟用服務TE。要修復，請在集線器端配置它：

hub#config-trans
hub(config)# sdwan
hub(config-vrf-global)# service TE vrf global
hub(config-vrf-global)# commit

檢查分支1的OMP表中是否已更改，現在將此路由作為C、I、R用於來自中心10.10.100的條目（生成興趣流量之前），並獲取來自分支2 10.10.10.2的條目的C、I、R（生成興趣流量）。此外，檢查分支1和分支2之間的BFD會話，並且使用命令show sdwan system on-demand remote-system <remote system ip>啟用按需隧道：

Before interest traffic

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

AFFINITY 
                                   PATH               ATTRIBUTE GROUP 
TENANT   VPN PREFIX      FROM PEER ID LABEL STATUS    TYPE     TLOC IP        COLOR      ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0        10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R    installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.1 62 1003 I,U,IA   installed 10.10.10.2     default    ipsec   -          None None - 
                        192.168.0.1 64 1005 C,R      installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.1 65 1003 I,U,IA   installed 10.10.10.2     private1   ipsec   -          None None - 
                        192.168.0.1 67 1005 Inv,U    installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.1 68 1003 I,U,IA   installed 10.10.10.2     private2   ipsec   -          None None - 
                        192.168.0.2 71 1005 C,R      installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.2 72 1003 U,IA     installed 10.10.10.2     default    ipsec   -          None None - 
                        192.168.0.2 74 1005 C,R      installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.2 75 1003 U,IA     installed 10.10.10.2     private1   ipsec   -          None None - 
                        192.168.0.2 77 1005 Inv,U    installed 10.10.10.100   blue       ipsec   -          None None - 
                        192.168.0.2 78 1003 U,IA     installed 10.10.10.2     private2   ipsec   -          None None -

While interest traffic

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                            AFFINITY 
                                  PATH             ATTRIBUTE                                GROUP 
TENANT VPN PREFIX      FROM PEER  ID LABEL STATUS  TYPE      TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10 10.2.2.2/32 192.168.0.1 61 1005 R        installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.1 62 1003 C,I,R    installed 10.10.10.2     default       ipsec - None None - 
                      192.168.0.1 64 1005 R        installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.1 65 1003 C,I,R    installed 10.10.10.2     private1      ipsec - None None - 
                      192.168.0.1 67 1005 Inv,U    installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.1 68 1003 C,I,R    installed 10.10.10.2     private2      ipsec - None None - 
                      192.168.0.2 71 1005 R        installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.2 72 1003 C,R      installed 10.10.10.2     default       ipsec - None None - 
                      192.168.0.2 74 1005 R        installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.2 75 1003 C,R      installed 10.10.10.2     private1      ipsec - None None - 
                      192.168.0.2 77 1005 Inv,U    installed 10.10.10.100   blue          ipsec - None None - 
                      192.168.0.2 78 1003 C,R      installed 10.10.10.2     private2      ipsec - None None -

Spoke 1#show sdwan bfd sessions 
                                      SOURCE TLOC REMOTE TLOC            DST PUBLIC      DST PUBLIC      DETECT TX
SYSTEM IP         SITE ID    STATE     COLOR       COLOR   SOURCE IP      IP              PORT    ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100       100         up      blue        blue    10.10.10.1     10.100.100.1    12366   ipsec    7        1000     1:23:58:15 2
10.10.10.2         2           up      default     default 10.10.10.1     10.12.12.2      12366   ipsec    7        1000     0:00:01:50 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2         2           up      blue        blue    10.10.10.1     10.12.12.2      12366   ipsec    7        1000     0:00:01:52 2

Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2 yes      active  41 ------>on-demand tunnel established to spoke 2 10.10.10.2 due of interest traffic

案例 2: 輻條之間的BFD會話保持開啟

症狀

在這種情況下，遠端分支2終結點列在按需遠端終結點中(使用命令show sdwan system on-demand remote-system顯示)，且狀態為無按需狀態，即使沒有傳送任何感興趣的通訊量，並且直接從分支2學習目標字首，分支1和分支2之間的BFD會話仍保持運行

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2 no        -     - 

Spoke 1#show sdwan bfd sessions 
                           SOURCE TLOC REMOTE TLOC           DST PUBLIC   DST PUBLIC       DETECT TX
SYSTEM IP    SITE ID STATE COLOR       COLOR      SOURCE IP  IP           PORT       ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100      up   blue        blue       10.10.10.1 10.100.100.1 12366      ipsec 7           1000 1:23:58:15 3
10.10.10.2   2        up   default     default    10.10.10.1 10.12.12.2   12366      ipsec 7           1000 0:00:18:53 4
10.10.10.2   2        up   blue        blue       10.10.10.1 10.12.12.2   12366      ipsec 7           1000 0:00:18:52 3

Spoke 1#show sdwan omp route vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                          AFFINITY 
                                     PATH              ATTRIBUTE                                          GROUP 
TENANT VPN PREFIX          FROM PEER ID LABEL STATUS   TYPE      TLOC IP      COLOR      ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10 10.2.2.2/32     192.168.0.1 73 1005 R        installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.1 74 1003 C,I,R    installed 10.10.10.2    default   ipsec  -          None       None      -  
                          192.168.0.1 76 1005 R        installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.1 77 1003 C,I,R    installed 10.10.10.2    private1  ipsec  -          None       None      - 
                          192.168.0.1 79 1005 Inv,U    installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.1 80 1003 C,I,R    installed 10.10.10.2    private2  ipsec  -          None       None      - 
                          192.168.0.2 89 1005 R        installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.2 90 1003 C,R      installed 10.10.10.2    default   ipsec  -          None       None      - 
                          192.168.0.2 92 1005 R        installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.2 93 1003 C,R      installed 10.10.10.2    private1  ipsec  -          None       None      - 
                          192.168.0.2 95 1005 Inv,U    installed 10.10.10.100  blue      ipsec  -          None       None      - 
                          192.168.0.2 96 1003 C,R      installed 10.10.10.2    private2  ipsec  -          None       None      -

疑難排解

檢查按需隧道策略，確認所有站點都根據其角色（中心或分支）包括在正確的站點清單中

viptela-policy:policy
 control-policy ondemand
    sequence 1
     match route
      site-list Spokes
      prefix-list _AnyIpv4PrefixList
     !
     action accept
      set
       tloc-action backup
       tloc-list hub
      !
     !
    !
  default-action accept
 !
 lists
  site-list Spokes
   site-id 1-2 
  !
  tloc-list hub
   tloc 10.10.10.100 color blue encap ipsec 
   tloc 10.10.10.100 color default encap ipsec 
   tloc 10.10.10.100 color private1 encap ipsec 
   tloc 10.10.10.100 color private2 encap ipsec 
  !
  prefix-list _AnyIpv4PrefixList
   ip-prefix 0.0.0.0/0 le 32 
  !
 !
!
apply-policy
 site-list Spokes
  control-policy ondemand out
 !
!

使用show sdwan run指令檢查是否啟用按需模式 | 分支和TE中的inc on-demand在集線器中通過命令show sdwan run啟用 | 包括TE

Spoke 1#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10

Spoke 2#show sdwan run | inc on-demand
Spoke 2#

Hub#show sdwan run | inc TE
service TE vrf global

解決方案

在這種情況下，未在分支2中啟用按需模式。要修復，請在分支2端配置它

Spoke 2#config-trans
Spoke 2(config)# system
Spoke 2(config-vrf-global)# on-demand enable
Spoke 2(config-vrf-global)# on-demand idle-timeout 10
Spoke 2(config-vrf-global)# commit

檢查分支1中現在分支2是否被視為按需是，且OMP表已更改，並且現在對於來自中心10.10.10.100（生成興趣流量之前）而不是直接來自分支2的條目，此路由為C、I、R

Spoke 1#show sdwan system on-demand remote-system 
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2 yes inactive - 

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

AFFINITY 
        PATH ATTRIBUTE GROUP 
TENANT VPN PREFIX       FROM PEER   ID LABEL STATUS TYPE     TLOC IP      COLOR       ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10  10.2.2.2/32  192.168.0.1 61 1005 C,I,R  installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.1 62 1003 I,U,IA installed 10.10.10.2    default    ipsec      -        None    None - 
                        192.168.0.1 64 1005 C,R    installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.1 65 1003 I,U,IA installed 10.10.10.2    private1   ipsec      -        None    None - 
                        192.168.0.1 67 1005 Inv,U  installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.1 68 1003 I,U,IA installed 10.10.10.2    private2   ipsec      -        None    None - 
                        192.168.0.2 71 1005 C,R    installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.2 72 1003 U,IA   installed 10.10.10.2    default    ipsec      -        None    None - 
                        192.168.0.2 74 1005 C,R    installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.2 75 1003 U,IA   installed 10.10.10.2    private1   ipsec      -        None    None - 
                        192.168.0.2 77 1005 Inv,U  installed 10.10.10.100  blue       ipsec      -        None    None - 
                        192.168.0.2 78 1003 U,IA   installed 10.10.10.2    private2   ipsec      -        None    None -

當生成興趣流量時，來自分支2 10.10.10.2的條目的獲取了C、I、R。此外，檢查分支1和分支2之間的BFD會話是否已啟動，並檢查按需隧道是否已啟動 show sdwan system on-demand remote-system <remote system ip>

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

                                                                                                                AFFINITY 
                                               PATH               ATTRIBUTE                                     GROUP 
TENANT  VPN        PREFIX          FROM PEER   ID LABEL STATUS    TYPE     TLOC IP      COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0       10         10.2.2.2/32     192.168.0.1 61 1005 R         installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.1 62 1003 C,I,R     installed 10.10.10.2    default  ipsec   - None None - 
                                   192.168.0.1 64 1005 R         installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.1 65 1003 C,I,R     installed 10.10.10.2    private1 ipsec   - None None - 
                                   192.168.0.1 67 1005 Inv,U     installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.1 68 1003 C,I,R     installed 10.10.10.2    private2 ipsec   - None None - 
                                   192.168.0.2 71 1005 R         installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.2 72 1003 C,R       installed 10.10.10.2    default  ipsec   - None None - 
                                   192.168.0.2 74 1005 R         installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.2 75 1003 C,R       installed 10.10.10.2    private1 ipsec   - None None - 
                                   192.168.0.2 77 1005 Inv,U     installed 10.10.10.100  blue     ipsec   - None None - 
                                   192.168.0.2 78 1003 C,R       installed 10.10.10.2    private2 ipsec   - None None -

Spoke 1#show sdwan bfd sessions 
                        SOURCE TLOC REMOTE TLOC             DST PUBLIC  DST PUBLIC          DETECT      TX
SYSTEM IP SITE ID STATE COLOR       COLOR       SOURCE IP   IP          PORT         ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100  up blue          blue         10.10.10.1 10.100.100.1 12366       ipsec     7        1000 2:04:34:11 2
10.10.10.2   2    up default       default      10.10.10.1 10.12.12.2   12366       ipsec     7        1000 0:00:02:10 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2   2    up blue          blue         10.10.10.1 10.12.12.2   12366       ipsec     7        1000 0:00:02:08 2

Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2        10.10.10.2 yes      active   41 ------>on-demand tunnel established to Spoke 2 10.10.10.2 due of interest traffic

場景3：沒有從集線器發出的備份路由被租賃或安裝在輻條中

症狀

在這種情況下，在OMP表中，對於源自Spoke 2的字首10.2.2.2/32，沒有備份路由，只能看到按需的非活動條目。已確認已配置輪輻中的按需和集線器中的TE

Spoke 1#show sdwan omp route vpn 10 10.2.2.2/32 
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

AFFINITY 
PATH ATTRIBUTE GROUP 
TENANT VPN      PREFIX     FROM PEER   ID LABEL STATUS TYPE     TLOC IP   COLOR   ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10      10.2.2.2/32 192.168.0.1 108 1003 U,IA installed 10.10.10.2 default  ipsec -             None  None - 
                           192.168.0.1 113 1003 U,IA installed 10.10.10.2 private1 ipsec -             None  None - 
                           192.168.0.1 141 1003 U,IA installed 10.10.10.2 private2 ipsec -             None  None - 
                           192.168.0.2 112 1003 U,IA installed 10.10.10.2 default  ipsec -             None  None - 
                           192.168.0.2 117 1003 U,IA installed 10.10.10.2 private1 ipsec -             None  None - 
                           192.168.0.2 144 1003 U,IA installed 10.10.10.2 private2 ipsec -             None  None - 



Spoke 1#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10

Spoke 2#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10

Hub#show sdwan run | inc TE
service TE vrf global

疑難排解

檢查按需集中策略，並確認是否所有輻條都包含在正確的站點清單中

viptela-policy:policy
 control-policy ondemand
    sequence 1
     match route
      site-list Spokes
      prefix-list _AnyIpv4PrefixList
     !
     action accept
      set
       tloc-action backup
       tloc-list hub
      !
     !
    !
  default-action accept
 !
 lists
  site-list Spokes
   site-id 1 
  !
  tloc-list hub
   tloc 10.10.10.100 color blue encap ipsec 
   tloc 10.10.10.100 color default encap ipsec 
   tloc 10.10.10.100 color private1 encap ipsec 
   tloc 10.10.10.100 color private2 encap ipsec 
  !
  prefix-list _AnyIpv4PrefixList
   ip-prefix 0.0.0.0/0 le 32 
  !
 !
!
apply-policy
 site-list Spokes
  control-policy ondemand out
 !

解決方案

請注意，策略中的站點清單輻條中缺少Spoke 2站點ID 2。將其包括在站點清單中後，備份路徑會正確安裝，當傳送關注流量時，會啟動按需隧道和分支之間的BFD會話。

Spokes site list from policy before
lists 
site-list Spokes 
site-id 1 
!

Spokes site list from policy after
lists
site-list Spokes 
site-id 1-2
!

Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated

AFFINITY 
PATH ATTRIBUTE GROUP 
TENANT VPN PREFIX           FROM PEER   ID LABEL STATUS TYPE      TLOC IP      COLOR    ENCAP PREFERENCE NUMBER REGION ID REGION PATH 
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0      10  10.2.2.2/32      192.168.0.1 61 1005 C,I,R   installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.1 62 1003 I,U,IA  installed 10.10.10.2   default  ipsec    -        None     None - 
                            192.168.0.1 64 1005 C,R     installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.1 65 1003 I,U,IA  installed 10.10.10.2   private1 ipsec    -        None     None - 
                            192.168.0.1 67 1005 Inv,U   installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.1 68 1003 I,U,IA  installed 10.10.10.2   private2 ipsec    -        None     None - 
                            192.168.0.2 71 1005 C,R     installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.2 72 1003 U,IA    installed 10.10.10.2   default  ipsec    -        None     None - 
                            192.168.0.2 74 1005 C,R     installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.2 75 1003 U,IA    installed 10.10.10.2   private1 ipsec    -        None     None - 
                            192.168.0.2 77 1005 Inv,U   installed 10.10.10.100 blue     ipsec    -        None     None - 
                            192.168.0.2 78 1003 U,IA    installed 10.10.10.2   private2 ipsec    -        None     None -

Spoke 1#show sdwan bfd sessions 
SOURCE                     TLOC REMOTE TLOC DST PUBLIC     DST PUBLIC              DETECT        TX
SYSTEM IP    SITE ID STATE COLOR       COLOR    SOURCE IP  IP           PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100   100   up    blue         blue    10.10.10.1 10.100.100.1 12366 ipsec  7          1000         2:07:01:43 6
10.10.10.2      2    up    default      default 10.10.10.1 10.12.12.2   12366 ipsec  7          1000         0:00:00:56 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2      2    up    blue         blue    10.10.10.1 10.12.12.2   12366 ipsec  7          1000         0:00:00:56 2

Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2       10.10.10.2 yes      active    56 ------>on-demand tunnel established to Spoke 2 10.10.10.2 due of interest traffic

有用的命令

show sdwan system on-demand
show sdwan system on-demand remote-system
show sdwan system on-demand remote-system system-ip <system ip>
show sdwan run | 包括按需提供
show sdwan run | 包括TE
show sdwan ompo routes vpn <vpn number>

修訂記錄

修訂	發佈日期	意見
1.0	05-Oct-2023	初始版本

由思科工程師貢獻

Daniel Alva Vargas
技術諮詢工程師

這份文件是否有所幫助？

意見

讓思科協助您

開啟支援問題單
(需有思科服務合約)

SD-WAN動態按需隧道故障排除

無偏見用語

關於此翻譯

目錄

簡介

必備條件

採用元件

背景資訊

工作場景

使用的拓撲

Triger按需通道啟用

常見問題場景

使用的拓撲

場景1：通過輻條認為無效且無法解析的集線器的備份路徑

症狀

疑難排解

解決方案

案例 2: 輻條之間的BFD會話保持開啟

症狀

疑難排解

解決方案

場景3：沒有從集線器發出的備份路由被租賃或安裝在輻條中

症狀

疑難排解

解決方案

有用的命令

修訂記錄

由思科工程師貢獻

這份文件是否有所幫助？

讓思科協助您

本文件適用於這些產品