Courseiva
VPNGlobal Config

interface tunnel [number]

Creates a tunnel interface for encapsulating traffic (e.g., GRE, IPsec) to connect remote networks over an untrusted intermediate network.

Definition: interface tunnel [number] is a Cisco IOS global config command. Creates a tunnel interface for encapsulating traffic (e.g., GRE, IPsec) to connect remote networks over an untrusted intermediate network.

Overview

The `interface tunnel [number]` command is a fundamental building block in Cisco IOS for creating virtual point-to-point or multipoint tunnel interfaces. These interfaces encapsulate traffic within another protocol (e.g., GRE, IPsec, IP-in-IP) to transport packets across an untrusted intermediate network, such as the Internet, as if they were on a private link. This capability is essential for connecting geographically dispersed branch offices, enabling VPNs, and supporting overlay networks like DMVPN or MPLS over GRE.

The tunnel interface acts as a logical interface; once configured, you can apply routing protocols, ACLs, QoS policies, and other features just like on a physical interface. The key networking concept is encapsulation: the original packet (including its IP header) is wrapped in a new outer header (e.g., GRE) with a destination address of the remote tunnel endpoint. This allows protocols that are not routable over the public network (e.g., EIGRP, OSPF, or even non-IP protocols) to traverse it.

You would reach for this command when you need to connect private networks over a public infrastructure, create a secure site-to-site VPN, or build a dynamic multipoint VPN (DMVPN) hub-and-spoke topology. Alternatives include using a physical interface with a direct leased line (expensive and inflexible), a Layer 2 VPN like VPLS (more complex), or a cloud-based SD-WAN solution (different paradigm). The tunnel interface fits into the broader workflow of designing a WAN: after planning IP addressing and routing, you create the tunnel interface, configure the tunnel source and destination, set the tunnel mode (e.g., GRE, IPsec), and then enable routing over it.

Important IOS behaviors: the tunnel interface is down until both endpoints are configured and reachable; the command is available in global configuration mode; changes take effect immediately and are written to the running config; there is no privilege level restriction beyond the standard enable mode. The tunnel number is locally significant and can range from 0 to 2147483647, but typical practice uses small numbers (0-255). The interface must be assigned an IP address (or use an unnumbered reference) to participate in routing.

Common pitfalls include forgetting to configure the tunnel source and destination, mismatched tunnel modes, or incorrect MTU handling causing fragmentation. Understanding this command is critical for CCNA and CCNP candidates as it underpins VPN technologies and overlay networks.

Syntax·Global Config
interface tunnel [number]

When to Use This Command

  • Connecting two branch offices over the internet using a GRE tunnel to carry private routing protocols.
  • Building a site-to-site IPsec VPN tunnel between a corporate HQ and a remote office.
  • Creating a multipoint GRE (mGRE) tunnel for Dynamic Multipoint VPN (DMVPN) deployments.
  • Tunneling IPv6 traffic over an IPv4-only network using a configured IPv6-over-IPv4 tunnel.

Parameters

ParameterSyntaxDescription
number<0-2147483647>The tunnel interface number, locally significant on the router. Valid values range from 0 to 2147483647, but typical deployments use small numbers (e.g., 0, 1, 10). Common mistakes include using a number already assigned to another tunnel interface (duplicate) or using a number that conflicts with other interface types (e.g., Tunnel0 vs Loopback0 – they are separate namespaces, so no conflict).

Command Examples

Basic GRE Tunnel Configuration

interface tunnel 0
Router(config)#interface tunnel 0
Router(config-if)#ip address 10.0.0.1 255.255.255.252
Router(config-if)#tunnel source 192.168.1.1
Router(config-if)#tunnel destination 203.0.113.1
Router(config-if)#tunnel mode gre ip
Router(config-if)#no shutdown

This output shows entering tunnel interface configuration mode for tunnel 0. The ip address command assigns a private IP to the tunnel. tunnel source sets the local physical interface IP (or interface name) as the tunnel source. tunnel destination specifies the remote endpoint IP. tunnel mode gre ip sets the encapsulation to GRE over IP. no shutdown activates the interface.

IPsec Tunnel Interface (VTI)

interface tunnel 1
Router(config)#interface tunnel 1
Router(config-if)#ip address 172.16.0.1 255.255.255.252
Router(config-if)#tunnel source GigabitEthernet0/0
Router(config-if)#tunnel destination 198.51.100.1
Router(config-if)#tunnel mode ipsec ipv4
Router(config-if)#tunnel protection ipsec profile VPN-PROFILE
Router(config-if)#no shutdown

This configuration creates a Virtual Tunnel Interface (VTI) for IPsec. tunnel mode ipsec ipv4 enables IPsec tunnel mode. tunnel protection ipsec profile applies an IPsec profile to encrypt traffic. The tunnel source uses an interface name instead of an IP address.

Understanding the Output

When configuring a tunnel interface, the output shows the prompt changing to Router(config-if)# indicating you are in interface configuration mode. The key fields to verify are: ip address (the tunnel's own IP), tunnel source (the local endpoint, either an IP or interface name), tunnel destination (the remote endpoint IP), and tunnel mode (e.g., gre ip, ipsec ipv4). A common issue is forgetting to set tunnel mode, which defaults to GRE.

Also ensure no shutdown is applied. In show interfaces tunnel 0 output, look for 'up/up' status; if down/down, check physical reachability or misconfigured endpoints. The tunnel source must be reachable from the destination and vice versa.

For IPsec tunnels, verify that the tunnel protection profile is correctly applied and that the IPsec session is active (use show crypto ipsec sa).

Configuration Scenarios

Configure a simple GRE tunnel between two branch routers

Two branch offices (R1 and R2) need to exchange private traffic (10.0.1.0/24 and 10.0.2.0/24) over the public Internet. A GRE tunnel provides a virtual point-to-point link.

Topology

R1(Gi0/0)---203.0.113.1/30---Internet---203.0.113.2/30---(Gi0/0)R2 Tunnel0: 172.16.0.1/30 on R1, 172.16.0.2/30 on R2

Steps

  1. 1.Step 1: Enter global configuration mode on R1: configure terminal
  2. 2.Step 2: Create tunnel interface 0: interface tunnel 0
  3. 3.Step 3: Configure tunnel source (physical interface or IP): tunnel source GigabitEthernet0/0
  4. 4.Step 4: Configure tunnel destination (remote public IP): tunnel destination 203.0.113.2
  5. 5.Step 5: Assign IP address to tunnel: ip address 172.16.0.1 255.255.255.252
  6. 6.Step 6: Set tunnel mode to GRE (default): tunnel mode gre ip
  7. 7.Step 7: Enable the interface: no shutdown
  8. 8.Step 8: Repeat similar steps on R2 with appropriate IPs.
Configuration
! R1 configuration
interface Tunnel0
 ip address 172.16.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 203.0.113.2
 tunnel mode gre ip
 no shutdown
!
! R2 configuration
interface Tunnel0
 ip address 172.16.0.2 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 203.0.113.1
 tunnel mode gre ip
 no shutdown

Verify: Use 'show ip interface brief' to verify Tunnel0 is up/up. Use 'ping 172.16.0.2 source 172.16.0.1' from R1 to test reachability. Expected output: success (!!!!!).

Watch out: Forgetting to configure a route to the tunnel destination via the physical interface. Without a route to 203.0.113.2, the tunnel source cannot send packets, and the tunnel stays down.

Configure an IPsec tunnel with GRE encapsulation for secure site-to-site VPN

A company needs to securely connect its headquarters (HQ) and a remote branch over the Internet. GRE provides routing flexibility, and IPsec encrypts the traffic. This scenario uses a crypto map to protect the GRE tunnel.

Topology

HQ(Gi0/0)---198.51.100.1/30---Internet---198.51.100.2/30---(Gi0/0)Branch Tunnel0: 10.0.0.1/30 on HQ, 10.0.0.2/30 on Branch

Steps

  1. 1.Step 1: On HQ, create ISAKMP policy: crypto isakmp policy 10; authentication pre-share; encryption aes 256; group 5; exit
  2. 2.Step 2: Configure pre-shared key: crypto isakmp key cisco123 address 198.51.100.2
  3. 3.Step 3: Create IPsec transform set: crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
  4. 4.Step 4: Create crypto ACL to protect GRE traffic: access-list 100 permit gre host 198.51.100.1 host 198.51.100.2
  5. 5.Step 5: Create crypto map: crypto map CMAP 10 ipsec-isakmp; set peer 198.51.100.2; set transform-set TS; match address 100; exit
  6. 6.Step 6: Apply crypto map to physical interface: interface GigabitEthernet0/0; crypto map CMAP
  7. 7.Step 7: Create GRE tunnel: interface Tunnel0; ip address 10.0.0.1 255.255.255.252; tunnel source GigabitEthernet0/0; tunnel destination 198.51.100.2; tunnel mode gre ip; no shutdown
  8. 8.Step 8: Repeat similar steps on Branch with reversed IPs.
Configuration
! HQ configuration
crypto isakmp policy 10
 authentication pre-share
 encryption aes 256
 group 5
crypto isakmp key cisco123 address 198.51.100.2
crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
access-list 100 permit gre host 198.51.100.1 host 198.51.100.2
crypto map CMAP 10 ipsec-isakmp
 set peer 198.51.100.2
 set transform-set TS
 match address 100
interface GigabitEthernet0/0
 crypto map CMAP
interface Tunnel0
 ip address 10.0.0.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 198.51.100.2
 tunnel mode gre ip
 no shutdown

Verify: Use 'show crypto isakmp sa' to verify Phase 1 (state MM_ACTIVE). Use 'show crypto ipsec sa' to verify Phase 2 (encapsulation #). Use 'ping 10.0.0.2 source 10.0.0.1' to test tunnel reachability.

Watch out: The crypto ACL must match the GRE protocol (protocol 47) between the public IPs. A common mistake is using an ACL that matches the inner private IPs instead of the outer GRE headers, causing IPsec to not encrypt the tunnel traffic.

Troubleshooting with This Command

When troubleshooting tunnel interfaces, the first step is to verify the interface state with `show ip interface brief | include Tunnel`. A healthy tunnel shows 'up/up'. If the interface is 'up/down' or 'administratively down', check the tunnel source and destination configuration.

Use `show interface tunnel [number]` to see detailed status: look for 'Tunnel source' and 'Tunnel destination' lines to confirm they match the peer. The 'Tunnel protocol/transport' line indicates the encapsulation mode (e.g., GRE/IP). A common problem indicator is 'Tunnel interface is down due to no route to destination' – this means the router cannot reach the tunnel destination IP via its routing table.

Verify with `show ip route [destination-ip]`; if missing, add a static route or ensure the physical interface has connectivity. Another key command is `show ip mtu` to check MTU issues; fragmentation can cause performance problems. For IPsec tunnels, use `show crypto isakmp sa` and `show crypto ipsec sa`.

Healthy Phase 1 shows state MM_ACTIVE; Phase 2 shows packets encaps/decaps incrementing. If Phase 1 is not established, check ISAKMP policy match, pre-shared keys, and reachability. If Phase 2 fails, verify the crypto ACL matches the GRE traffic (protocol 47) and that transform sets match.

For GRE tunnels without IPsec, `debug tunnel` can be used cautiously to see encapsulation events. A step-by-step diagnostic flow: 1) Check tunnel interface state; 2) Verify tunnel source/destination with `show run interface tunnel [number]`; 3) Ensure route to tunnel destination exists; 4) Ping the tunnel destination from the router (using the physical interface IP as source); 5) If ping fails, troubleshoot physical connectivity; 6) If ping succeeds but tunnel is down, check for ACLs blocking GRE (protocol 47) on intermediate firewalls; 7) For IPsec, check crypto SAs. Correlate with `show logging` for error messages like '%TUN-5-RECURDOWN' (recursive routing) or '%CRYPTO-4-RECVD_PKT_INV_SPI'.

Remember that tunnel interfaces can suffer from recursive routing if the tunnel destination is learned via the tunnel itself – always ensure the route to the tunnel destination points out the physical interface, not the tunnel.

CCNA Exam Tips

1.

CCNA exam tip: Remember that tunnel interfaces must have an IP address and both tunnel source and destination configured to be operational.

2.

CCNA exam tip: The default tunnel mode is GRE; if you need IPsec, you must explicitly set tunnel mode ipsec ipv4.

3.

CCNA exam tip: A tunnel interface will stay down if the tunnel destination is not reachable via routing; check the routing table.

4.

CCNA exam tip: In the exam, you may be asked to identify why a tunnel is down — common reasons include mismatched tunnel keys or ACLs blocking traffic.

Common Mistakes

Mistake 1: Forgetting to configure tunnel mode, leaving it as default GRE when IPsec is needed — results in no encryption.

Mistake 2: Using an incorrect tunnel source IP that is not reachable from the destination — tunnel stays down.

Mistake 3: Not applying no shutdown to the tunnel interface — interface remains administratively down.

interface tunnel [number] vs tunnel source [intf|ip]

The 'interface tunnel' and 'tunnel source' commands are commonly confused because they are both essential for tunnel configuration, yet they operate at different levels: one creates the tunnel interface and the other specifies the source address for the tunnel. Understanding their distinct roles is critical for correct VPN or overlay network setup.

Aspectinterface tunnel [number]tunnel source [intf|ip]
ScopeDefines the tunnel interface itself, including its logical presence in the routing table.Specifies the local source (interface or IP) that the tunnel uses as its endpoint.
Configuration modeGlobal configuration mode.Interface configuration mode (under the specific tunnel interface).
PersistenceCreates a persistent interface that survives device reboots unless removed.Persistent within the tunnel interface configuration; lost if the interface is removed.
PrecedenceMust be configured first to create the tunnel interface before other tunnel parameters.Configured after the interface is created; affects how the tunnel source is selected.
Typical useEstablishes the logical tunnel endpoint for GRE, IPsec, or other tunnel types.Defines which local IP address or interface serves as the source for outgoing tunnel packets.

Use 'interface tunnel [number]' when you need to create a new tunnel interface to interconnect remote networks over an untrusted network.

Use 'tunnel source [intf|ip]' when you need to specify the local source address or interface for an existing tunnel interface to control the exit point of encapsulated traffic.

Platform Notes

In IOS-XE (e.g., CSR1000v, ISR 4000 series), the `interface tunnel` command syntax and behavior are identical to classic IOS. However, IOS-XE supports additional tunnel modes like 'tunnel mode ipsec ipv4' for VTI (Virtual Tunnel Interface) which simplifies IPsec VPN configuration without a crypto map. The output of `show interface tunnel` may include additional counters like 'Tunnel hardware' details.

In NX-OS (Cisco Nexus switches), the equivalent command is `interface tunnel [number]` but with different subcommands; for example, tunnel mode is set with `tunnel mode gre` and tunnel source/destination with `tunnel source` and `tunnel destination`. NX-OS also supports 'tunnel mode ipsec' for VTI. On Cisco ASA firewalls, the concept is different: ASAs use 'interface tunnel [number]' for VTI-based IPsec VPNs, but the configuration is done via 'crypto ipsec profile' and 'tunnel mode ipsec ipv4'.

The ASA does not support GRE natively. In IOS-XR (e.g., ASR 9000), the command is `interface tunnel-te [number]` for MPLS TE tunnels, or `interface tunnel-ip [number]` for IP tunnels; GRE tunnels are configured under `interface tunnel-ip` with `tunnel mode gre`. IOS-XR syntax is significantly different and uses a hierarchical configuration model.

Across versions, the basic `interface tunnel` command has remained consistent from IOS 12.x to 16.x, but newer versions add features like 'tunnel mode mpls traffic-eng' and 'tunnel vrf'. Always check the specific platform documentation for exact syntax and capabilities.

Related Commands

show crypto ipsec sa

Displays the current state and statistics of IPsec security associations (SAs) to verify VPN tunnel establishment and monitor encrypted traffic.

tunnel destination [ip]

Specifies the destination IP address for a tunnel interface, used to define the remote endpoint of a point-to-point VPN tunnel.

tunnel source [intf|ip]

Specifies the source interface or IP address for a tunnel interface, used to define the tunnel's source address for VPN or overlay networks.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions