The tunnel destination address is the address of the peer interface receiving packets and should be configured as the source address of the peer tunnel interface.

Automatic tunnel interfaces using the same encapsulation protocol must have different source addresses. Manual tunnel interfaces using the same encapsulation protocol must have different source and destination addresses.

Examples

# VLAN-interface 100 of Sysname 1 uses the IP address 193.101.1.1 and VLAN-interface 100 of Sysname 2 uses the IP address 192.100.1.1. Configure source and destination addresses for the tunnel between Sysname 1 and Sysname 2.

// Configure the source address 193.101.1.1 and destination address 192.100.1.1 for the tunnel interface of Sysname 1.

<Sysname1> system-view

[Sysname1] interface tunnel 0

[Sysname1-Tunnel0] source 193.101.1.1

[Sysname1-Tunnel0] destination 192.100.1.1

// Configure the source address 192.100.1.1 and destination address 193.101.1.1 for the tunnel interface of Sysname 2.

<Sysname2> system-view

[Sysname2] interface tunnel 1

[Sysname2-Tunnel1] source 192.100.1.1

[Sysname2-Tunnel1] destination 193.101.1.1

# GigabitEthernet 1/0/5 of Sysname 1 uses the IP address 193.101.1.1 and GigabitEthernet 1/0/5 of Sysname 2 uses the IP address 192.100.1.1. Configure source and destination addresses for the tunnel between Sysname 1 and Sysname 2.

// Configure the source address 193.101.1.1 and destination address 192.100.1.1 for the tunnel interface of Sysname 1.

<Sysname1> system-view

[Sysname1] interface tunnel 0

[Sysname1-Tunnel0] source 193.101.1.1

[Sysname1-Tunnel0] destination 192.100.1.1

// Configure the source address 192.100.1.1 and destination address 193.101.1.1 for the tunnel interface of Sysname 2.

<Sysname2> system-view

[Sysname2] interface tunnel 1

[Sysname2-Tunnel1] source 192.100.1.1

[Sysname2-Tunnel1] destination 193.101.1.1

Related commands

· source

· interface tunnel

· display interface tunnel

· display ipv6 interface tunnel

display interface tunnel

Use display interface tunnel to display information about tunnel interfaces, including the source address, destination address, and tunnel mode.

Syntax

display interface [ tunnel ] [ brief [ down ] ] [ | { begin | exclude | include } regular-expression ]

display interface tunnel number [ brief ] [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

number: Number of a tunnel interface.

brief: Displays brief interface information. If you do not specify this keyword, the command displays detailed interface information.

down: Displays information about interfaces in the DOWN state and the causes. If you do not specify this keyword, this command displays information about interfaces in all states.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Usage guidelines

If you do not specify the tunnel keyword, this command displays information about all interfaces on the device.

If you specify the tunnel keyword without the number argument, this command displays information about all existing tunnel interfaces.

Examples

# Display detailed information about interface Tunnel 0.

<Sysname> display interface tunnel 0

Tunnel0 current state: UP

Line protocol current state: UP

Description: Tunnel0 Interface

The Maximum Transmit Unit is 1476

Internet Address is 1.1.1.1/24 Primary

Encapsulation is TUNNEL, service-loopback-group ID not set.

Tunnel source 10.1.1.1, destination 10.1.1.2

Tunnel bandwidth 64 (kbps)

Tunnel keepalive enabled, Period(50 s), Retries(3)

Tunnel protocol/transport GRE/IP

GRE key disabled

Checksumming of GRE packets disabled

Last clearing of counters: Never

Last 300 seconds input: 0 bytes/sec, 0 packets/sec

Last 300 seconds output: 0 bytes/sec, 0 packets/sec

0 packets input, 0 bytes

0 input error

0 packets output, 0 bytes

0 output error

Table 1 Command output

Field	Description
Tunnel0 current state	Physical state of the tunnel interface: · Administratively DOWN—The interface has been shut down by the shutdown command. · DOWN—The interface is administratively up but its physical state is down. · UP—Both the administrative and physical states of the interface are up.
Line protocol current state	Link layer state of the tunnel interface: · DOWN—The protocol state of the interface is down. · UP—The protocol state of the interface is up.
Description	Description of the tunnel interface.
Maximum Transmit Unit	MTU of the tunnel interface.
Internet Address	IP address of the tunnel interface. If no IP address is assigned to the interface, "Internet protocol processing : disabled" is displayed, which means that the tunnel interface cannot process packets. Primary indicates it is the primary IP address of the interface. Sub indicates it is a secondary IP address of the interface.
Encapsulation is TUNNEL	The encapsulation protocol is tunnel.
service-loopback-group ID	ID of the service loopback group referenced by the tunnel. If service loopback group is not supported or not specified, "service-loopback-group ID not set" is displayed.
Tunnel source	Source address of the tunnel.
destination	Destination address of the tunnel.
Tunnel bandwidth	Bandwidth of the tunnel interface.
Tunnel keepalive enabled, Period(50 s), Retries(3)	GRE keepalive is enabled to detect the state of the tunnel interface. In this example, keepalive packets are sent every 50 seconds, and the maximum retries are three.
Tunnel protocol/transport	Tunnel mode and transport protocol: · GRE/IP—GRE over IPv4 tunnel mode. · GRE/IPv6—GRE over IPv6 tunnel mode. · IPsec/IP—IPsec over IPv4 tunnel mode. · IPsec/IPv6—IPsec over IPv6 tunnel mode.
GRE key disabled	Tunnel interface key option of GRE is not configured.
Checksumming of GRE packets disabled	GRE packet checksum function is disabled.
Last clearing of counters	Last time of clearing of counters.
Last 300 seconds input: 0 bytes/sec, 0 packets/sec	Average input rate in the last 300 seconds in bytes/sec or packets/sec.
Last 300 seconds output: 0 bytes/sec, 0 packets/sec	Average output rate in the last 300 seconds in bytes/sec or packets/sec.
packets input	Total number of input packets.
input error	Number of input error packets.
packets output	Total number of output packets.
output error	Number of output error packets.

# Display brief information about interface Tunnel 0.

<Sysname> display interface tunnel 0 brief

The brief information of interface(s) under route mode:

Link: ADM - administratively down; Stby - standby

Protocol: (s) - spoofing

Interface Link Protocol Main IP Description

Tun0 UP UP 1.1.1.1

# Display brief information about the interface Tunnel 1 in the DOWN state.

<Sysname> display interface tunnel brief down

The brief information of interface(s) under route mode:

Link: ADM - administratively down; Stby - standby

Interface Link Cause

Tun1 DOWN Not connected

Table 2 Command output

Field	Description
The brief information of interface(s) under route mode	Brief information about Layer 3 interfaces.
Link: ADM - administratively down; Stby - standby	Link status: · ADM—The interface has been administratively shut down by the undo shutdown command. · Stby—The interface is a backup interface. To see the primary interface, use the display standby state command in High Availability Command Reference.
Protocol: (s) - spoofing	(s) indicates that the network layer protocol state is UP, but the link is not available because it is either an on-demand link or not present at all.
Interface	Abbreviated interface name.
Link	Physical link state of the interface: · UP—The link is physically up. · DOWN—The link is physically down. · ADM—The link has been administratively shut down. To bring it up, perform the undo shutdown command. · Stby—The interface is a backup interface.
Protocol	Protocol state: · DOWN—The protocol is disabled. · UP—The protocol is enabled.
Main IP	Primary IP address of the interface.
Description	Description of the interface.
Cause	Cause of a DOWN physical link. If the port has been shut down with the shutdown command, this field displays Administratively. To bring up the port, use the undo shutdown command.

Related commands

· interface tunnel

· source

· destination

· tunnel-protocol

display ipv6 interface tunnel

Use display ipv6 interface tunnel to display IPv6 information for tunnel interfaces.

Syntax

display ipv6 interface tunnel [ number ] [ brief ] [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

number: Displays IPv6 information on a specific tunnel interface. If no interface number is specified, IPv6 information about all tunnel interfaces is displayed.

brief: Displays brief information of tunnel interfaces. If this keyword is not specified, detailed information and IPv6 packet statistics for tunnel interfaces are displayed.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Examples

# Display detailed IPv6 information and IPv6 packet statistics for interface Tunnel 0.

<Sysname> display ipv6 interface tunnel 0

Tunnel0 current state :UP

Line protocol current state :UP

IPv6 is enabled, link-local address is FE80::202:201

Global unicast address(es):

3000::1, subnet is 3000::/64

Joined group address(es):

FF02::1:FF02:201

FF02::1:FF00:1

FF02::1:FF00:0

FF02::2

FF02::1

MTU is 1480 bytes

ND reachable time is 30000 milliseconds

ND retransmit interval is 1000 milliseconds

Hosts use stateless autoconfig for addresses

IPv6 Packet statistics:

InReceives: 45

InTooShorts: 0

InTruncatedPkts: 0

InHopLimitExceeds: 0

InBadHeaders: 0

InBadOptions: 0

ReasmReqds: 0

ReasmOKs: 0

InFragDrops: 0

InFragTimeouts: 0

OutFragFails: 0

InUnknownProtos: 0

InDelivers: 45

OutRequests: 45

OutForwDatagrams: 0

InNoRoutes: 0

InTooBigErrors: 0

OutFragOKs: 0

OutFragCreates: 0

InMcastPkts: 0

InMcastNotMembers: 0

OutMcastPkts: 0

InAddrErrors: 0

InDiscards: 0

OutDiscards: 0

Table 3 Command output

Field	Description
Tunnel0 current state	Physical state of the tunnel interface: · Administratively DOWN—The interface has been shut down by the shutdown command. · DOWN—The interface is administratively up but its physical state is down. · UP—Both the administrative and physical states of the interface are up.
Line protocol current state	Link layer state of the tunnel interface: · DOWN—Indicates that the protocol state of the interface is down. · UP—Indicates that the protocol state of the interface is up.
IPv6 is enabled	IPv6 packet forwarding state of the tunnel interface. IPv6 packet forwarding is automatically enabled after an IPv6 address is assigned to the interface. IPv6 packet forwarding is enabled in the example.
link-local address	Link-local address configured for the tunnel interface.
Global unicast address(es)	Global unicast addresses configured for the tunnel interface.
Joined group address(es)	Multicast addresses of the tunnel interface.
MTU is 1480 bytes	Maximum transmission unit of the tunnel interface. It is 1480 bytes in the example.
ND reachable time	Neighbor reachable time.
ND retransmit interval	Interval for retransmitting a neighbor solicitation message.
Hosts use stateless autoconfig for addresses	Hosts use stateless autoconfiguration mode to acquire IPv6 addresses.
InReceives	All IPv6 packets received by the tunnel interface, including types of error packets.
InTooShorts	Received IPv6 packets that are too short, with a length less than 40 bytes, for example.
InTruncatedPkts	Received IPv6 packets with a length less than that specified in the packets.
InHopLimitExceeds	Received IPv6 packets with a hop count exceeding the limit.
InBadHeaders	Received IPv6 packets with bad basic headers.
InBadOptions	Received IPv6 packets with bad extension headers.
ReasmReqds	Received IPv6 fragments.
ReasmOKs	Number of packets after reassembly rather than the number of fragments.
InFragDrops	IPv6 fragments discarded due to certain errors.
InFragTimeouts	IPv6 fragments discarded because the interval for which they had stayed in the system buffer exceeded the specified period.
OutFragFails	Packets failed in fragmentation on the outbound interface.
InUnknownProtos	Received IPv6 packets with unknown or unsupported protocol type.
InDelivers	Received IPv6 packets that were delivered to application layer protocols (such as ICMPv6, TCP, and UDP).
OutRequests	Local IPv6 packets sent by IPv6 application protocols.
OutForwDatagrams	Packets forwarded by the outbound interface.
InNoRoutes	IPv6 packets that were discarded because no matched route can be found.
InTooBigErrors	IPv6 packets that were received normally but discarded before they were forwarded because they exceeded the PMTU.
OutFragOKs	Packets that were fragmented on the outbound interface.
OutFragCreates	Number of packet fragments after fragmentation on the outbound interface.
InMcastPkts	IPv6 multicast packets received on the interface.
InMcastNotMembers	Incoming IPv6 multicast packets that were discarded because the interface did not belong to the corresponding multicast groups.
OutMcastPkts	IPv6 multicast packets sent by the interface.
InAddrErrors	IPv6 packets that were discarded due to invalid destination addresses.
InDiscards	Received IPv6 packets that were discarded due to resource problems rather than packet content errors.
OutDiscards	Sent packets that were discarded due to resource problems rather than packet content errors.

# Display brief IPv6 information for interface Tunnel 0.

<Sysname> display ipv6 interface tunnel 0 brief

*down: administratively down

(s): spoofing

Interface Physical Protocol IPv6 Address

Tunnel0 up up 3000::1

Table 4 Command output

Field	Description
*down	The tunnel interface is administratively shut down by the shutdown command.
(s)	Spoofing attribute of the tunnel interface. The link protocol state of the tunnel interface is up, but the link does not exist, or the link is established on demand, instead of being permanent.
Interface	Name of the tunnel interface.
Physical	Physical state of the tunnel interface: · *down—The interface has been shut down by the shutdown command. · down—The interface is administratively up but its physical state is down. · up—Both the administrative and physical states of the interface are up.
Protocol	Link layer protocol state of the tunnel interface: · down—The protocol state of the interface is down. · up—The protocol state of the interface is up.
IPv6 Address	IPv6 address of the tunnel interface. Only the first of configured IPv6 addresses is displayed. If no address is configured for the interface, Unassigned is displayed.

gre checksum

Use gre checksum to enable GRE packet checksum. This feature verifies the validity of packets and discards invalid packets.

Use undo gre checksum to disable GRE packet checksum.

Syntax

gre checksum

undo gre checksum

Default

GRE packet checksum is disabled.

Views

Tunnel interface view

Default command level

2: System level

Examples

# Enable GRE packet checksum for the tunnel between devices Sysname1 and Sysname2.

// Enable GRE packet checksum on Sysname1.

<Sysname1> system-view

[Sysname1] interface tunnel 3

[Sysname1-Tunnel3] gre checksum

// Enable GRE packet checksum on Sysname2.

<Sysname2> system-view

[Sysname2] interface tunnel 2

[Sysname2-Tunnel2] gre checksum

Related commands

· interface tunnel

· display interface tunnel

gre key

Use gre key to configure a key for a GRE tunnel interface.

Use undo gre key to remove the configuration.

Syntax

gre key key-number

undo gre key

Default

No key is configured for a GRE tunnel interface.

Views

Tunnel interface view

Default command level

2: System level

Parameters

key-number: Key for the GRE tunnel interface, in the range of 0 to 4294967295.

Usage guidelines

For a P2P GRE tunnel, both ends of the tunnel must be configured with the same GRE key. Otherwise, packets cannot pass the GRE key verification and will be discarded. This weak security mechanism can prevent packets from being received mistakenly.

Examples

# Set the key for the GRE tunnel interfaces to 123 on devices Sysname1 and Sysname2.

// Set the GRE key to 123 for GRE tunnel interface 3 on Sysname1.

<Sysname1> system-view

[Sysname1] interface tunnel 3

[Sysname1-Tunnel3] gre key 123

// Set the GRE key to 123 for GRE tunnel interface 2 on Sysname2.

<Sysname2> system-view

[Sysname2] interface tunnel 2

[Sysname2-Tunnel2] gre key 123

Related commands

· interface tunnel

· display interface tunnel

gre recursion

Use gre recursion to specify a value for the Recursion Control field in the GRE header.

Use undo gre recursion to restore the default.

Syntax

gre recursion recursion-value

undo gre recursion

Default

The value of the Recursion Control field in the GRE header is 0, which means not to limit the number of encapsulations.

Views

Tunnel interface view

Default command level

2: System level

Parameters

recursion-value: Value for the Recursion Control field in the GRE header, in the range of 1 to 7.

Usage guidelines

To work with devices that require the Recursion Control field not to be 0, use this command to set the Recursion Control field to a nonzero value. The value of the Recursion Control field does not affect how many times the H3C device encapsulates a GRE packet.

Examples

# Set the Recursion Control field in the GRE header to 1.

<Sysname1> system-view

[Sysname1] interface tunnel 3

[Sysname1-Tunnel3] gre recursion 1

interface tunnel

Use interface tunnel to create a tunnel interface and enter tunnel interface view.

Use undo interface tunnel to delete a specific tunnel interface.

Syntax

interface tunnel number

undo interface tunnel number

Default

No tunnel interface is created on the device.

Views

System view

Default command level

2: System level

Parameters

number: Number of the tunnel interface, in the range of 0 to 255. The number of tunnel interfaces that can be created is restricted by the total number of interfaces and the memory.

Usage guidelines

Use the interface tunnel command to enter the interface view of a specific tunnel. If the specified tunnel interface does not exist, the system creates the interface and enters its view.

A tunnel interface number is locally significant. The tunnel interfaces on the two ends of a tunnel can use the same or different interface numbers.

Examples

# Create interface Tunnel 3 and enter tunnel interface view.

<Sysname> system-view

[Sysname] interface tunnel 3

[Sysname-Tunnel3]

Related commands

· display interface tunnel

· display ipv6 interface tunnel

· source

· destination

· tunnel-protocol

keepalive

Use keepalive to enable GRE keepalive for a tunnel interface and set the keepalive interval and the maximum number of attempts for transmitting a keepalive packet.

Use undo keepalive to disable GRE keepalive.

Syntax

keepalive [ seconds [ times ] ]

undo keepalive

Default

GRE keepalive is disabled.

Views

Tunnel interface view

Default command level

2: System level

Parameters

seconds: Interval in seconds for transmitting keepalive packets, in the range of 1 to 32767. The default value is 10.

times: Maximum number of attempts for transmitting a keepalive packet, in the range of 1 to 255. The default value is 3.

Usage guidelines

With GRE keepalive enabled on a tunnel interface, the device sends GRE keepalive packets from the tunnel interface periodically. If no response is received from the peer within the specified interval, the device retransmits a keepalive packet. If the device still receives no response from the peer after sending the keepalive packet for the maximum number of attempts, the local tunnel interface goes down and stays down until it receives a keepalive acknowledgement packet from the peer.

Examples

# Set the GRE keepalive interval to 20 seconds and the maximum number of transmission attempts to 5.

<Sysname> system-view

[Sysname] interface tunnel 0

[Sysname-Tunnel0] keepalive 20 5

Related commands

· interface tunnel

· display interface tunnel

source

Use source to specify the source address or source interface for a tunnel interface.

Use undo source to restore the default.

Syntax

source { ip-address | ipv6-address | interface-type interface-number }

undo source

Default

No source address or source interface is specified for a tunnel interface.

Views

Tunnel interface view

Default command level

2: System level

Parameters

ip-address: Tunnel source IPv4 address.

ipv6-address: Tunnel source IPv6 address.

interface-type interface-number: Specifies the source interface type and number.

Usage guidelines

The tunnel source address is the address of the interface sending packets and should be configured as the destination address of the peer tunnel interface.

Examples

# Set the tunnel source address to 192.100.1.1 on the interface Tunnel 5.

<Sysname> system-view

[Sysname] interface tunnel 5

[Sysname-Tunnel5] source 192.100.1.1

Or set the tunnel source interface to VLAN-interface 100.

<Sysname> system-view

[Sysname] interface tunnel 5

[Sysname-Tunnel5] source vlan-interface 100

# Set the tunnel source address to 192.100.1.1 on the interface Tunnel 5.

<Sysname> system-view

[Sysname] interface tunnel 5

[Sysname-Tunnel5] source 192.100.1.1

Or set the tunnel source interface to GigabitEthernet 1/0/5.

<Sysname> system-view

[Sysname] interface tunnel 5

[Sysname-Tunnel5] source GigabitEthernet1/0/5

Related commands

· destination

· interface tunnel

· display interface tunnel

· display ipv6 interface tunnel

tunnel discard ipv4-compatible-packet

Use tunnel discard ipv4-compatible-packet to enable dropping of IPv6 packets using IPv4-compatible IPv6 addresses.

Use undo tunnel discard ipv4-compatible-packet to restore the default.

Syntax

tunnel discard ipv4-compatible-packet

undo tunnel discard ipv4-compatible-packet

Default

IPv6 packets using IPv4-compatible IPv6 addresses are not dropped.

Views

System view

Default command level

2: System level

Usage guidelines

The tunnel discard ipv4-compatible-packet command enables the device to check the source and destination IPv6 addresses of the de-encapsulated IPv6 packets from the tunnel and discard packets that use a source or destination IPv4-compatible IPv6 address.

Examples

# Enable dropping of IPv6 packets using IPv4-compatible IPv6 addresses.

<Sysname> system-view

[Sysname] tunnel discard ipv4-compatible-packet

tunnel-protocol

Use tunnel-protocol to specify the tunnel mode for a tunnel interface.

Use undo tunnel-protocol to restore the default.

Syntax

tunnel-protocol { gre [ ipv6 ] | ipsec { ipv4 | ipv6 } }

undo tunnel-protocol

Default

A tunnel interface runs in GRE over IPv4 tunnel mode.

Views

Tunnel interface view

Default command level

2: System level

Parameters

gre: Specifies the GRE over IPv4 tunnel mode.

gre ipv6: Specifies the GRE over IPv6 tunnel mode.

ipsec ipv4: Specifies the IPsec over IPv4 tunnel mode.

ipsec ipv6: Specifies the IPsec over IPv6 tunnel mode.

Usage guidelines

You can select a tunnel mode according to the actual network topology and application. The two ends of a tunnel must have the same tunnel mode specified. Otherwise, traffic transmission may fail.

Only one automatic tunnel can be created at the start point of a tunnel.

For more information about IPsec tunnel mode, see Security Configuration Guide.

Examples

# Specify the GRE over IPv4 tunnel mode for interface Tunnel 2.

<Sysname> system-view

[Sysname] interface tunnel 2

[Sysname-Tunnel2] tunnel-protocol gre

04-Layer 3 Command Reference

GRE configuration commands

destination

display interface tunnel

display ipv6 interface tunnel

gre checksum

gre key

gre recursion

interface tunnel

keepalive

source

tunnel discard ipv4-compatible-packet

tunnel-protocol

Cloud & AI

Intelligent Connection

Intelligent Computing

Intelligent Storage

Security

SMB Products

Intelligent Terminal Products

Industry Solutions

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Technical Blogs

Training & Certification

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Partner Business Management

Service Business

Profile

News & Events

Online Exhibition Center

Contact Us