tunnel destination [ip]
Specifies the destination IP address for a tunnel interface, used to define the remote endpoint of a point-to-point VPN tunnel.
Definition: tunnel destination [ip] is a Cisco IOS interface config command. Specifies the destination IP address for a tunnel interface, used to define the remote endpoint of a point-to-point VPN tunnel.
Overview
The `tunnel destination` command is a fundamental configuration directive used on Cisco IOS routers to specify the remote endpoint IP address for a tunnel interface. This command is essential for establishing point-to-point VPN tunnels, such as Generic Routing Encapsulation (GRE) tunnels, IPsec tunnels, or other overlay networks. By defining the destination IP address, the router knows where to send encapsulated packets, effectively creating a virtual point-to-point link across an underlying IP network.
The command is typically used in conjunction with `tunnel source` to define the local endpoint. Understanding this command is critical for network engineers designing site-to-site VPNs, DMVPN, or MPLS L3VPN overlays. It is often one of the first commands applied when configuring a tunnel interface, as without a destination, the tunnel cannot forward traffic.
The command operates at the interface configuration level and directly modifies the running configuration. It requires privileged EXEC mode (enable) to enter global configuration mode and then interface configuration mode. The command does not generate immediate output; instead, it silently updates the configuration.
A common mistake is using an incorrect or unreachable destination IP address, which will cause the tunnel to remain down. The command is supported across all IOS versions, including IOS-XE, and has equivalents in NX-OS and ASA platforms. In troubleshooting, verifying the tunnel destination is often the first step when a tunnel is not coming up, as it ensures the remote endpoint is correctly specified.
tunnel destination [ip]When to Use This Command
- Configuring the remote endpoint for a GRE tunnel between two branch offices.
- Setting the destination for an IPsec tunnel to connect a remote site to a central hub.
- Establishing a DMVPN tunnel by specifying the hub router's public IP as the destination.
- Defining the peer address for a multipoint tunnel in a hub-and-spoke VPN topology.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| ip | A.B.C.D | Specifies the destination IPv4 address of the tunnel endpoint. This must be a valid unicast IP address reachable from the local router. Common mistakes include using a broadcast or multicast address, or an address that is not routable between the tunnel endpoints. |
Command Examples
Basic GRE Tunnel Destination Configuration
Router(config-if)# tunnel destination 203.0.113.1Router(config-if)# %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
The command sets the remote tunnel endpoint to 203.0.113.1. The syslog message indicates the tunnel line protocol came up, meaning the destination is reachable and the tunnel is operational.
Verifying Tunnel Destination with Show Command
Router# show interfaces tunnel 0Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 10.0.0.1/30
MTU 1476 bytes, BW 100 Kbit/sec, DLY 50000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Tunnel source 192.168.1.1, destination 203.0.113.1
Tunnel protocol/transport GRE/IP
Key disabled, sequencing disabled
...The output shows the tunnel interface status and configuration. The 'Tunnel source' and 'destination' lines confirm the local and remote endpoints. 'Tunnel protocol/transport GRE/IP' indicates the encapsulation. The interface being 'up/up' means the tunnel is working.
Understanding the Output
The command itself does not produce output; it configures the tunnel destination. To verify, use 'show interfaces tunnel X' or 'show running-config interface tunnel X'. In the show output, look for 'Tunnel source' and 'destination' to confirm the endpoints.
The interface status 'up/up' indicates the tunnel is operational. If the line protocol is down, the destination may be unreachable or misconfigured. Pay attention to the tunnel protocol (e.g., GRE/IP, IPsec) to ensure correct encapsulation.
Configuration Scenarios
Configure a GRE tunnel between two branch routers
Two branch offices need to securely exchange routing information over the public internet using a GRE tunnel. The tunnel provides a virtual point-to-point link for routing protocols like OSPF.
Topology
Branch1 (Gi0/0: 203.0.113.1)---Internet---(Gi0/0: 203.0.113.2) Branch2Steps
- 1.Step 1: Enter privileged EXEC mode on Branch1: enable
- 2.Step 2: Enter global configuration mode: configure terminal
- 3.Step 3: Create tunnel interface: interface Tunnel0
- 4.Step 4: Set the tunnel source IP: tunnel source GigabitEthernet0/0
- 5.Step 5: Set the tunnel destination IP: tunnel destination 203.0.113.2
- 6.Step 6: Assign an IP address to the tunnel: ip address 10.0.0.1 255.255.255.252
- 7.Step 7: Enable the interface: no shutdown
- 8.Step 8: Repeat similar steps on Branch2 with source 203.0.113.2 and destination 203.0.113.1
! Branch1 configuration interface Tunnel0 ip address 10.0.0.1 255.255.255.252 tunnel source GigabitEthernet0/0 tunnel destination 203.0.113.2 ! Branch2 configuration interface Tunnel0 ip address 10.0.0.2 255.255.255.252 tunnel source GigabitEthernet0/0 tunnel destination 203.0.113.1
Verify: Use 'show interfaces tunnel 0' to verify the tunnel is up/up. Expected output includes 'Tunnel0 is up, line protocol is up'. Also use 'ping 10.0.0.2' from Branch1 to confirm connectivity.
Watch out: Ensure the tunnel source interface is up and has a route to the destination IP. If the destination is unreachable, the tunnel will stay down.
Configure an IPsec tunnel with tunnel protection
A company needs to encrypt traffic between two sites using IPsec. The tunnel destination is used to define the remote peer for the IPsec tunnel, which is then protected by a crypto map or tunnel protection profile.
Topology
SiteA (Gi0/0: 192.0.2.1)---Internet---(Gi0/0: 192.0.2.2) SiteBSteps
- 1.Step 1: On SiteA, enter global config: configure terminal
- 2.Step 2: Create tunnel interface: interface Tunnel0
- 3.Step 3: Set tunnel source: tunnel source GigabitEthernet0/0
- 4.Step 4: Set tunnel destination: tunnel destination 192.0.2.2
- 5.Step 5: Assign IP to tunnel: ip address 172.16.0.1 255.255.255.252
- 6.Step 6: Apply IPsec protection: tunnel protection ipsec profile VPN-PROFILE
- 7.Step 7: Enable the interface: no shutdown
- 8.Step 8: Repeat on SiteB with source 192.0.2.2 and destination 192.0.2.1
! SiteA configuration crypto ipsec profile VPN-PROFILE set transform-set AES256-SHA interface Tunnel0 ip address 172.16.0.1 255.255.255.252 tunnel source GigabitEthernet0/0 tunnel destination 192.0.2.2 tunnel protection ipsec profile VPN-PROFILE ! SiteB configuration crypto ipsec profile VPN-PROFILE set transform-set AES256-SHA interface Tunnel0 ip address 172.16.0.2 255.255.255.252 tunnel source GigabitEthernet0/0 tunnel destination 192.0.2.1 tunnel protection ipsec profile VPN-PROFILE
Verify: Use 'show crypto ipsec sa' to verify IPsec security associations. Expected output includes 'interface: Tunnel0' and 'peer address: 192.0.2.2' with 'encaps' and 'decaps' counters incrementing.
Watch out: The tunnel destination must match the peer address in the IPsec profile. If they differ, IPsec will not establish.
Troubleshooting with This Command
When troubleshooting tunnel issues, the `tunnel destination` command is a primary focus. A healthy tunnel interface will show 'up/up' in `show interfaces tunnel`. If the line protocol is down, it often indicates a problem with the destination reachability or misconfiguration.
Use `show ip route` to verify that the destination IP is reachable via the correct interface. If the route is missing, the tunnel will not come up. Additionally, `ping` from the router to the tunnel destination can confirm basic IP connectivity.
If ping fails, check ACLs, firewalls, or routing issues. Another useful command is `show tunnel` (on some IOS versions) which displays tunnel state and source/destination. For GRE tunnels, `show interfaces tunnel` will show 'Tunnel0 is up, line protocol is up' when the destination is reachable and the tunnel is operational.
If the line protocol is down, it may indicate that the remote tunnel endpoint is not configured or is misconfigured. Also, `debug tunnel` can be used to see tunnel events, but use with caution in production. Common symptoms include: tunnel interface up but line protocol down (destination unreachable), tunnel flapping (route instability), or no traffic flow (MTU issues).
Always verify the tunnel source and destination are correctly configured on both ends. For IPsec tunnels, `show crypto isakmp sa` and `show crypto ipsec sa` help correlate the tunnel destination with the peer. In summary, the `tunnel destination` command is the cornerstone of tunnel configuration; misconfiguration here leads to immediate failure.
CCNA Exam Tips
CCNA exam tip: The tunnel destination must be reachable via a route; otherwise, the tunnel will not come up.
CCNA exam tip: Remember that tunnel source and destination are required for point-to-point tunnels; multipoint tunnels use different commands.
CCNA exam tip: The tunnel destination IP is typically the public IP of the remote router; private IPs can be used if directly connected.
CCNA exam tip: In DMVPN, the tunnel destination is configured only on spoke routers pointing to the hub; hubs use dynamic mapping.
Common Mistakes
Mistake 1: Forgetting to configure a route to the tunnel destination, causing the tunnel to stay down.
Mistake 2: Using an incorrect IP address (e.g., private IP instead of public) for the destination, leading to unreachability.
Mistake 3: Configuring tunnel destination on a multipoint interface (tunnel mode gre multipoint) where it is not allowed; use tunnel destination only on point-to-point tunnels.
tunnel destination [ip] vs tunnel source [intf|ip]
These commands are commonly confused because both define tunnel endpoints but serve opposite roles: tunnel destination sets the remote peer IP, while tunnel source specifies the local source IP or interface. They are often used together to establish a point-to-point VPN tunnel.
| Aspect | tunnel destination [ip] | tunnel source [intf|ip] |
|---|---|---|
| Scope | Defines remote endpoint IP | Defines local source IP or interface |
| Configuration mode | Interface Config (tunnel) | Interface Config (tunnel) |
| Requirement | Required for most point-to-point tunnels | Optional; recommended for stability |
| Error if missing | Tunnel fails with 'no destination address' | Uses routing table to determine source |
| Typical usage | Set to remote VPN peer IP | Set to loopback or WAN interface IP |
Use tunnel destination [ip] when you need to specify the IP address of the remote tunnel endpoint.
Use tunnel source [intf|ip] when you need to explicitly control which local IP address the tunnel uses, typically for routing consistency or firewall rules.
Platform Notes
On IOS-XE, the `tunnel destination` command syntax is identical to classic IOS. However, output formats in `show interfaces tunnel` may differ slightly, with additional fields like 'Tunnel source/destination' clearly displayed. NX-OS uses the `interface tunnel` command with `destination` keyword, e.g., `destination 192.0.2.2` under the tunnel interface configuration mode.
The NX-OS equivalent is `destination` (without 'tunnel' prefix). On ASA platforms, tunnel configuration is done via crypto maps and tunnel groups, not directly with `tunnel destination`. For IOS-XR, the command is `destination` under the tunnel-ip configuration, e.g., `destination 192.0.2.2`.
There are no significant differences between IOS 12.x, 15.x, and 16.x for this command; it remains consistent. However, newer versions may support IPv6 tunnel destinations with `tunnel destination ipv6` syntax. Always check the specific platform documentation for exact syntax.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions