Trying to build a IP-IP tunnel from Azure hosted vSRX to MX240 device, The interface comes up and am able to ping the remote side however not the tunnel IP.
The following messages appear in /var/log/messages:
Aug 7 12:26:20 vsrx01 IFP error> ../../../../../../../../../src/pfe/usp/control/applications/interface/ifp.c@2509:(errno=100) create/update ipip tunnel failed 1
Aug 7 12:26:20 vsrx01 IFP error> ../../../../../../../../../src/pfe/usp/control/applications/interface/ifp.c@3393:(errno=100) tunnel session add(ip-0/0/0) failed
The following configuration is done on the vSRX side.
set security zones security-zone trust interfaces ip-0/0/0.0
set security zones security-zone trust interfaces ge-0/0/1.0
set security zones security-zone untrust interfaces ge-0/0/0.0
set interfaces ge-0/0/0 unit 0 family inet address x.x.x.x/29
set interfaces ip-0/0/0 unit 0 tunnel source y.y.y.y
set interfaces ip-0/0/0 unit 0 tunnel destination a.a.a.a
set interfaces ip-0/0/0 unit 0 tunnel path-mtu-discovery
set interfaces ip-0/0/0 unit 0 family inet address a.b.c.d/30
set interfaces ge-0/0/1 unit 0 family inet address y.y.y.y/28
set interfaces fxp0 unit 0
set routing-instances VR1 interface ge-0/0/0.0
set routing-instances VR1 interface ip-0/0/0.0
set routing-instances VR1 interface ge-0/0/1.0
user@router> show interfaces terse | match "ge-|ip-"
ge-0/0/0 up up
ge-0/0/0.0 up up inet x.x.x.x/29
ip-0/0/0 up up
ip-0/0/0.0 up up inet a.b.c.d/30
ge-0/0/1 up up
ge-0/0/1.0 up up inet y.y.y.y/28
user@router> show route
inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
...............
VR1.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
0.0.0.0/0 *[Static/5] 00:59:18
> to y.y.y.b via ge-0/0/0.0
.................
a.b.c.d/30 *[Direct/0] 00:34:54
> via ip-0/0/0.0
a.b.c.d/32 *[Local/0] 00:34:54
Local via ip-0/0/0.0
user@router> ping 8.X.X.8 routing-instance VR1 count 1
PING 8.X.X.8 (8.X.X.8): 56 data bytes
64 bytes from 8.X.X.8: icmp_seq=0 ttl=56 time=80.586 ms
user@router> ping (remote Ip) routing-instance VR1 count 1
PING a.a.a.a (remote IP): 56 data bytes
64 bytes from a.a.a.a: icmp_seq=0 ttl=61 time=5.823 ms
However the remote tunnel IP is not reachable.
As per Document published by Azure, Azure does not allow GRE and IP-IP traffic in the network.
https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#what-protocols-can-i-use-within-vnets
You can use TCP, UDP, ESP, AH, and ICMP TCP/IP protocols within VNets. Unicast is supported within VNets. Multicast, broadcast, IP-in-IP encapsulated packets, and Generic Routing Encapsulation (GRE) packets are blocked within VNets. You cannot use Dynamic Host Configuration Protocol (DHCP) via Unicast (source port UDP/68 / destination port UDP/67). UDP source port 65330 which is reserved for the host. See "Can I deploy a DHCP server in a VNet" for more detail what is and is not supported for DHCP.
Document Created