GRE tunnels vs static routes

Moderator: Queue Moderator

Post Reply
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

GRE tunnels vs static routes

Post by Bill_G »

Our Trbo team is building out a new multi-site repeater system for a customer with a lot of locations they want to unify. As large as the customer is, there is internal inertia and resistance to building out the necessary static ip links between the sites to tie it all together. In fact, it's taken months, and they still can't seem to agree among themselves what to do. So, our team is moving forward with the project using Cradlepoint LTE routers on Verizon service to form the backbone of a limited three site roll out as proof of concept.

I was asked to make the link work, and ran into a little weirdness. I could make port forwarding work which satisfies the system requirements, but doesn't pass any other traffic between sites. I could not get static routes working at all. I couldn't get any of the supported routing protocols to do what was needed. But! I could get GRE to work. Passes traffic perfectly between the three subnets without port forwarding, you can ping every device, and RDAC works. It does not support VPN remote client sessions. So, for now, you have to be on site to touch the network.

Very strange. GRE is a fancy version of static routing. Verizon and Cradlepoint tech support is lean. Since the product isn't broken, it's a customer configuration issue which is a value added service.

I am not a layer 3 expert. I muddle. I get by. Any thoughts on why GRE would work, and why static routing did not?
jsilberberg
Posts: 47
Joined: Wed Sep 28, 2005 1:55 pm

Re: GRE tunnels vs static routes

Post by jsilberberg »

Bill,

Use VPN Tunnels not GRE. They are on page 139 Section 7.6
http://www.cradlepoint.com/sites/defaul ... al_4.2.pdf

Most probably you will also need to use a service link DYNDNS unless you are purchasing Static IPs from Verizon.

An finally be careful of your subnets so your routing works correctly when the VPN links are up.

-----------

By the way I did something similar for a customer recently, but I used the CBR400 and then pfSense Firewall boxes behind them instead of this CradlePoint only because I thought it gave me a little more flexibility in the long run.
J. Silberberg
CompuDesigns, Inc.
Atlanta, GA.
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

Re: GRE tunnels vs static routes

Post by Bill_G »

jsilberberg wrote:Bill,

Use VPN Tunnels not GRE. They are on page 139 Section 7.6
http://www.cradlepoint.com/sites/defaul ... al_4.2.pdf

Most probably you will also need to use a service link DYNDNS unless you are purchasing Static IPs from Verizon.

An finally be careful of your subnets so your routing works correctly when the VPN links are up.

-----------

By the way I did something similar for a customer recently, but I used the CBR400 and then pfSense Firewall boxes behind them instead of this CradlePoint only because I thought it gave me a little more flexibility in the long run.
Thanks. I can make that recommendation. If I were to implement something like that, I'd set the IBR600s to passthrough, and use Juniper Netscreens (personal preference). But, not my project.

OTOH, the GRE tunnels made it easy to pass the udp packets because they pass all services. Is there a specific reason you chose to use VPN tunnels instead?
TreyH
Posts: 82
Joined: Sat Mar 19, 2011 6:27 am

Re: GRE tunnels vs static routes

Post by TreyH »

We use a tunnel device made by DCB Inc. to connect our sites when a public internet link is used. Like jsilberberg mentioned you would need to use a service like DYNDNS or have a static public IP address at one location which would act as a master. The other units connect as clients to the master and can use dynamic ips. What's nice about them is you don't have to worry about routing and you can keep all your IP equipment in the same subnet. They pass all ethernet protocols and multicast between all the units.

http://www.dcbnet.com/datasheet/ut3302ds.html
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

Re: GRE tunnels vs static routes

Post by Bill_G »

That's a thought. I've used DCB equipment in conjunction with Telex consoles quite a bit. It's a pretty straight forward appliance. It's another good recommendation. Thanks.
jsilberberg
Posts: 47
Joined: Wed Sep 28, 2005 1:55 pm

Re: GRE tunnels vs static routes

Post by jsilberberg »

Bill_G wrote:
jsilberberg wrote:Bill,

OTOH, the GRE tunnels made it easy to pass the udp packets because they pass all services. Is there a specific reason you chose to use VPN tunnels instead?
I have done some GRE tunnels in the past, mostly with Telex solutions. Although I also prefer the DCBNet hardware for that. I just find that the VPN tunnels tend to work better, and if needed you can run GRE over the IPSEC/VPN Tunnel as well but now the data is encrypted / protected..
J. Silberberg
CompuDesigns, Inc.
Atlanta, GA.
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

Re: GRE tunnels vs static routes

Post by Bill_G »

jsilberberg wrote:
Bill_G wrote:
jsilberberg wrote:Bill,

OTOH, the GRE tunnels made it easy to pass the udp packets because they pass all services. Is there a specific reason you chose to use VPN tunnels instead?
I have done some GRE tunnels in the past, mostly with Telex solutions. Although I also prefer the DCBNet hardware for that. I just find that the VPN tunnels tend to work better, and if needed you can run GRE over the IPSEC/VPN Tunnel as well but now the data is encrypted / protected..
Okay. Thanks. I'm not too worried about data security since it is just voice traffic on a voice network that is physically independent from the customer's data network. But, if using a VPN makes it more robust, we can switch them over.
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

Re: GRE tunnels vs static routes

Post by Bill_G »

(snort) CradlePoint tech support finally responded - they want me to upgrade the units with the latest firmware and factory reset them before they will proceed with assistance. Shades of Canopy support ...
User avatar
FMROB
Posts: 1002
Joined: Sun Jan 12, 2003 2:28 pm

Re: GRE tunnels vs static routes

Post by FMROB »

Bill, I have to ask, why go through all those gyrations. Does the customer have a specific reason not using the public network? I am under the assumption that in a IPSC system only the master site needs the static IP.
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

Re: GRE tunnels vs static routes

Post by Bill_G »

FMROB wrote:Bill, I have to ask, why go through all those gyrations. Does the customer have a specific reason not using the public network? I am under the assumption that in a IPSC system only the master site needs the static IP.
Part of the problem was the customer's IT dept. Big company with lots of internal inertia and territorialism. The road for the request to tie the three locations together through their existing enterprise network has been bumpy. Lots of meetings, lots of conference calls, and no action. So, our Trbo group decided to use these M2M (machine to machine) cellular routers to get it done. Static routes is how I decided to do it through Verizon, and because it was going through the Internet, I had to employ GRE or IPSec tunnels to join the subnets behind the NAT at each end. I was also able to do it with port forwarding which also requires static addresses to work correctly. But, then you cannot manage any of the other devices. There are probably other ways to do it. This seemed the simplest and easiest method that left a migration path for the next phases in the project.
User avatar
FMROB
Posts: 1002
Joined: Sun Jan 12, 2003 2:28 pm

Re: GRE tunnels vs static routes

Post by FMROB »

I know the world of hurt with corporate IT depts. We have the same issues here as well. That cradlepoint device you linked to, is that is a gsm cellular device that provides an IP connection to the internet? That looks to be a nifty device. What's the monthly charge on that?
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

Re: GRE tunnels vs static routes

Post by Bill_G »

It's v.kitchensink. 2G to LTE. There are other devices out there. This is the one the Verizon rep suggested. I dunno the cost. It's not totally intuitive, but it's pretty close to being an appliance. Uses setup wizards for configurations, but they will let you set it up wrong. The reason our Trbo guys ran into trouble started with Verizon. Verizon knew there were three nodes, and they assigned three static addresses. But, they set the subnet mask to .252 which guaranteed they wouldn't work right out of the gate. Once I got that straightened out, it was just a matter of building the tunnels to join the NAT subnets.

ETA - let me explain this a little better. Verizon assigned static addys of .184, .185, and .186 with a netmask of 255.255.255.252. Because of the addresses they chose, .184 is outside the subnet. It doesn't come into the subnet until you use a netmask of .240.
User avatar
wavetar
Administrator
Posts: 7340
Joined: Sun Sep 09, 2001 4:00 pm

Re: GRE tunnels vs static routes

Post by wavetar »

Bill, did this experiment work for you?

I am looking at setting up a couple of IPSC repeaters via cellular as a proof of concept and showcasing later on.

I have two Sixnet SN-6721 HSPA/LTE routers (nice units) provisioned with static IP addresses. I have good cell signal & good internet surfing speeds. However, round trip pings from one to the other average 500ms. Since TRBO specifies 60-90ms, I'm wondering how IPSC would even work, without using C-Bridge units at each end?
No trees were harmed in the posting of this message...however an extraordinarily large number of electrons were horribly inconvenienced.

Welcome to the /\/\achine.
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

Re: GRE tunnels vs static routes

Post by Bill_G »

Overall, it's a success. Zero problems with the Cradlepoint modems. But, we have had issues with Verizon in the late afternoon when their network gets busy. Maybe once a week or so. Lots of dr pped w rds and som tim s get bub le v ice from fr me loss. Dif icu t t un erst nd. And then it all clears up later. The customer understands the limitation, and is copeing with it. They are exploring other wireless carriers, but none can cover all their locations.
User avatar
wavetar
Administrator
Posts: 7340
Joined: Sun Sep 09, 2001 4:00 pm

Re: GRE tunnels vs static routes

Post by wavetar »

So high latency doesn't seem to be causing you issues, for the most part. I'll report back once I have my setup running.

FWIW, I can surf the internet through the modems and get ping times to servers in the 60ms range when using a website such as speedtest.net. But pinging from one unit to another results in the first ping taking 1500-1800ms, the subsequent pings in the 600ms range. Immediate pings afterwards stay at the 600ms range, but if given even say 10 seconds rest, the first ping again takes the near two seconds.
No trees were harmed in the posting of this message...however an extraordinarily large number of electrons were horribly inconvenienced.

Welcome to the /\/\achine.
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

Re: GRE tunnels vs static routes

Post by Bill_G »

Whoa. Sounds like the tunnels shut down after a bit. Is there a keep alive in there somewhere?
User avatar
wavetar
Administrator
Posts: 7340
Joined: Sun Sep 09, 2001 4:00 pm

Re: GRE tunnels vs static routes

Post by wavetar »

Bill_G wrote:Whoa. Sounds like the tunnels shut down after a bit. Is there a keep alive in there somewhere?
I haven't set the tunnels up yet...doing some reading to get to that point. I know enough to be neighborhood I.T. support, but in reality should be considered very dangerous, lol.
No trees were harmed in the posting of this message...however an extraordinarily large number of electrons were horribly inconvenienced.

Welcome to the /\/\achine.
User avatar
Bill_G
Posts: 3087
Joined: Thu Sep 17, 2009 5:00 am

Re: GRE tunnels vs static routes

Post by Bill_G »

wavetar wrote:
Bill_G wrote:Whoa. Sounds like the tunnels shut down after a bit. Is there a keep alive in there somewhere?
I haven't set the tunnels up yet...doing some reading to get to that point. I know enough to be neighborhood I.T. support, but in reality should be considered very dangerous, lol.
That's me too. I successfully muddle.
User avatar
wavetar
Administrator
Posts: 7340
Joined: Sun Sep 09, 2001 4:00 pm

Re: GRE tunnels vs static routes

Post by wavetar »

Update - finally found time to devote to this today & now have two XPR8400 repeaters doing IP Site Connect through the LTE modems.

Once I moved things to an area with decent LTE signal, my round trip ping times dropped and stabilized significantly. They now both average approx 200ms during several minutes of continuous pinging from one laptop to another, over varying LTE signal strength from -82dBm to -95dBm (closing our install bay door results in a 13db drop in signal)

I'm surprised in a way, since I left the repeaters on the 'normal' messaging delay setting of 60ms. Even 'high' is only supposed to support 90ms...yet I don't seem to be having any real issues. Voice sounds fine...no dropped syllables or robotic sounding voice...well, no MORE robotic sounding than TRBO normally is, lol.
No trees were harmed in the posting of this message...however an extraordinarily large number of electrons were horribly inconvenienced.

Welcome to the /\/\achine.
User avatar
judoka
Posts: 46
Joined: Thu Oct 27, 2005 4:37 pm

Re: GRE tunnels vs static routes

Post by judoka »

Very long initial ping times usually caused by arp-cache miss at the sender and a wide-area LAN if you ping an IP address. DNS lookup issues if you ping a "name"
Most hosts have about 15 minute timeout on the cache so it is also possible that you have tunnel timer problems. You can exclude arp problems if the pings pass through at least one router (because the local router should be responding to arp resolution requests).
tvsjr
Posts: 4118
Joined: Fri Nov 28, 2003 9:46 am

Re: GRE tunnels vs static routes

Post by tvsjr »

wavetar wrote:Update - finally found time to devote to this today & now have two XPR8400 repeaters doing IP Site Connect through the LTE modems.

Once I moved things to an area with decent LTE signal, my round trip ping times dropped and stabilized significantly. They now both average approx 200ms during several minutes of continuous pinging from one laptop to another, over varying LTE signal strength from -82dBm to -95dBm (closing our install bay door results in a 13db drop in signal)

I'm surprised in a way, since I left the repeaters on the 'normal' messaging delay setting of 60ms. Even 'high' is only supposed to support 90ms...yet I don't seem to be having any real issues. Voice sounds fine...no dropped syllables or robotic sounding voice...well, no MORE robotic sounding than TRBO normally is, lol.
I'm surprised your LTE ping times are that high. I usually see <100ms... low latency is one of the cool parts of LTE. In the truck, running a Cradlepoint router, I often see <50ms.
User avatar
wavetar
Administrator
Posts: 7340
Joined: Sun Sep 09, 2001 4:00 pm

Re: GRE tunnels vs static routes

Post by wavetar »

tvsjr wrote: I'm surprised your LTE ping times are that high. I usually see <100ms... low latency is one of the cool parts of LTE. In the truck, running a Cradlepoint router, I often see <50ms.
Do you mean between two cradlepoints, or to a website? I also see pings in the 50-80ms range when testing LTE bandwidth speed on websites, but between modems the lowest I've seen is 140ms, with the average being approx 200ms.
No trees were harmed in the posting of this message...however an extraordinarily large number of electrons were horribly inconvenienced.

Welcome to the /\/\achine.
tvsjr
Posts: 4118
Joined: Fri Nov 28, 2003 9:46 am

Re: GRE tunnels vs static routes

Post by tvsjr »

wavetar wrote:
tvsjr wrote: I'm surprised your LTE ping times are that high. I usually see <100ms... low latency is one of the cool parts of LTE. In the truck, running a Cradlepoint router, I often see <50ms.
Do you mean between two cradlepoints, or to a website? I also see pings in the 50-80ms range when testing LTE bandwidth speed on websites, but between modems the lowest I've seen is 140ms, with the average being approx 200ms.
Duh... I missed that part. That's Cradlepoint to data center via IPSec tunnel... not CP to CP. 140-200 is reasonable for LTE to LTE.
Post Reply

Return to “MotoTRBO Portables and Mobiles (4xxx/6xxx) 1.0 Series Subscribers”