GRE隧道因递归路由而关闭

7162

Created On 01/03/25 17:51 PM - Last Modified 10/17/25 13:28 PM

Symptom

System logs report a critical event for GRE tunnel interface down with recursive routing :

admin@syadav-vm-1-vm-100> show log system direction equal backward subtype equal gre
cmd#00008 2023-04-06 16:32:39 (show log system direction equal backward subtype equal gre)
Time                Severity Subtype Object EventID ID Description
===============================================================================
2023/04/07 00:29:27 critical gre     gre-tu tunnel- 0  Tunnel intf: tunnel.1 is going down due to recursive routing

Environment

GRE 隧道
下一代防火墙

Cause

出现此错误的最常见原因是到 GRE 对等方的路由通过 GRE隧道接口本身进行解析。

Resolution

验证 GRE 对等体的路由表条目： Use the following command to check if the route to the GRE peer is resolving via the GRE tunnel interface:
```
> test routing fib-lookup virtual-router <name-of-virtual-router> ip <IP-address-of-GRE-peer>
```
If the output shows that the next hop for the GRE peer's IP address is the GRE tunnel interface, it confirms that this is the cause of the recursive routing issue.
配置或编辑路由、静态路由或基于PBF策略的转发规则：确保到 GRE 对等方的路由通过物理接口或另一个隧道解析，而不是通过 GRE隧道本身解析。
验证更改： After making changes, recheck the routing for the GRE peer using the
```
> test routing fib-lookup virtual-router <name-of-virtual-router> ip <IP-address-of-GRE-peer>
```
command to confirm that the next hop does not resolve to the GRE tunnel interface.
监控隧道状态：监控隧道状态：Confirm that the GRE tunnel interface status changes to UP by monitoring the interface status in the GUI or CLI:
```
> show interface tunnel.<tunnel number>
```

Additional Information

如果路由配置正确，并且防火墙处于HA活动/被动状态，请检查是否遇到此问题：
PAN-200946
修复了活动/被动HA配置中防火墙的问题，即被动防火墙启动时，GRE 隧道由于递归路由而关闭。当被动防火墙变为主动防火墙且未配置递归路由时，GRE隧道仍处于关闭状态。
修复后的发布版本： 10.1.9、10.2.4、11.0.5 及更高版本。

此外，对于较旧的 PAN-OS 版本，请检查是否遇到问题：
PAN-179413
修复了提交作业期间 GRE 隧道发生故障的问题。
修复后的发布版本： 10.0.10、10.1.5 及更高版本。