tunnel source [intf|ip]
Specifies the source interface or IP address for a tunnel interface, used to define the tunnel's source address for VPN or overlay networks.
Definition: tunnel source [intf|ip] is a Cisco IOS interface config command. Specifies the source interface or IP address for a tunnel interface, used to define the tunnel's source address for VPN or overlay networks.
Overview
The 'tunnel source' command is a fundamental configuration directive in Cisco IOS that specifies the source interface or IP address for a tunnel interface. This command is critical for establishing VPN tunnels, Generic Routing Encapsulation (GRE) tunnels, IPsec tunnels, and other overlay networks. The tunnel source defines the local endpoint of the tunnel, which is used as the source IP address in the encapsulated packets.
Without a properly configured tunnel source, the tunnel interface cannot initialize, and traffic will not be forwarded through the tunnel. The command is typically used in conjunction with 'tunnel destination' to define the remote endpoint. The networking concept behind this command is the creation of a virtual point-to-point link between two devices over an underlying IP network.
The tunnel source can be either a physical interface (e.g., GigabitEthernet0/0) or a loopback interface, which provides stability because loopback interfaces are always up as long as the router is operational. Using a loopback interface as the tunnel source is a best practice for high availability, as it decouples the tunnel endpoint from any single physical interface. Network engineers reach for this command when configuring site-to-site VPNs, DMVPN, MPLS L3VPN, or any scenario requiring traffic to be transported over an overlay.
Alternatives include using a static IP address or relying on dynamic routing protocols to determine the source, but the tunnel source command provides explicit control. In the broader configuration workflow, the tunnel interface is created first with 'interface tunnel <number>', then the tunnel source is set, followed by the tunnel destination, and finally the encapsulation mode (e.g., 'tunnel mode gre ip'). Important IOS behaviors: the command takes effect immediately and is written to the running configuration; it requires privileged EXEC mode (enable) to configure; the source interface must have an IP address assigned; if the source interface goes down, the tunnel interface will also go down (unless a loopback is used).
The command is available in all IOS versions, including IOS-XE, and has no privilege level restrictions beyond standard interface configuration. Understanding this command is essential for CCNA and CCNP candidates as it appears in VPN and overlay network topics.
tunnel source [intf|ip]When to Use This Command
- Configuring the source interface for a GRE tunnel between two routers over a WAN link.
- Setting a loopback interface as the tunnel source for stability in a DMVPN deployment.
- Using a specific IP address as the tunnel source when multiple IPs exist on an interface.
- Changing the tunnel source during maintenance to redirect traffic through a backup interface.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| interface-type interface-number | GigabitEthernet0/0, Loopback0, etc. | Specifies the source interface for the tunnel. The interface must have an IP address configured. Common choices include physical interfaces (e.g., GigabitEthernet0/0) or loopback interfaces for stability. A common mistake is using an interface that is down or has no IP address, causing the tunnel to fail. |
| ip-address | A.B.C.D | Specifies the source IP address directly. This IP must be configured on the router and reachable from the tunnel destination. Using an IP address instead of an interface can lead to issues if the IP changes or the interface goes down. A common mistake is using an IP that is not local to the router. |
Command Examples
Setting tunnel source to an interface
tunnel source GigabitEthernet0/1Router(config-if)# tunnel source GigabitEthernet0/1 Router(config-if)# end Router# show interfaces tunnel 0 Tunnel0 is up, line protocol is up Hardware is Tunnel Internet address is 10.0.0.1/30 Tunnel source 192.168.1.1 (GigabitEthernet0/1), destination 192.168.2.1 Tunnel protocol/transport GRE/IP ...
The command sets the tunnel source to the IP address of GigabitEthernet0/1 (192.168.1.1). The output shows the tunnel interface details, including the source interface and IP.
Setting tunnel source to a specific IP address
tunnel source 10.0.0.1Router(config-if)# tunnel source 10.0.0.1 Router(config-if)# end Router# show interfaces tunnel 0 Tunnel0 is up, line protocol is up Hardware is Tunnel Internet address is 10.0.0.2/30 Tunnel source 10.0.0.1, destination 10.0.0.2 Tunnel protocol/transport GRE/IP ...
The command sets the tunnel source to the IP address 10.0.0.1 directly. The output confirms the source IP is used without referencing an interface.
Understanding the Output
The 'show interfaces tunnel' command displays tunnel source information. The 'Tunnel source' field shows the configured source IP address and optionally the interface name in parentheses. A valid source IP should be reachable and belong to the router.
If the source is down or misconfigured, the tunnel may not come up. Watch for mismatched source/destination IPs or unreachable sources.
Configuration Scenarios
Configure a GRE tunnel between two branch routers using loopback as source
Two branch offices need to connect their internal networks over the internet using a GRE tunnel. Using loopback interfaces ensures the tunnel remains up even if one physical link fails.
Topology
Branch1(Lo0:10.1.1.1)---Gi0/0(203.0.113.1)---Internet---(203.0.113.2)Gi0/0---Branch2(Lo0:10.2.2.2)Steps
- 1.Step 1: On Branch1, enter global configuration mode: configure terminal
- 2.Step 2: Create loopback interface and assign IP: interface Loopback0, ip address 10.1.1.1 255.255.255.255
- 3.Step 3: Create tunnel interface: interface Tunnel0
- 4.Step 4: Set tunnel source to loopback: tunnel source Loopback0
- 5.Step 5: Set tunnel destination to Branch2's public IP: tunnel destination 203.0.113.2
- 6.Step 6: Set tunnel mode to GRE IP: tunnel mode gre ip
- 7.Step 7: Assign IP to tunnel interface: ip address 172.16.0.1 255.255.255.252
- 8.Step 8: Repeat similar steps on Branch2 with appropriate IPs.
! Branch1 configuration interface Loopback0 ip address 10.1.1.1 255.255.255.255 ! interface Tunnel0 ip address 172.16.0.1 255.255.255.252 tunnel source Loopback0 tunnel destination 203.0.113.2 tunnel mode gre ip ! ! Branch2 configuration interface Loopback0 ip address 10.2.2.2 255.255.255.255 ! interface Tunnel0 ip address 172.16.0.2 255.255.255.252 tunnel source Loopback0 tunnel destination 203.0.113.1 tunnel mode gre ip
Verify: Use 'show ip interface brief' to verify Tunnel0 is up/up. Use 'ping 172.16.0.2' from Branch1 to test tunnel connectivity. Expected output: success.
Watch out: A common mistake is forgetting to configure a route to the tunnel destination network via the physical interface; otherwise, the tunnel may not come up.
Configure an IPsec tunnel with source interface as physical interface
A remote site needs to connect to the head office using an IPsec VPN. The tunnel source is set to the physical interface facing the internet, which is the default behavior.
Topology
Remote(R1:Gi0/0 198.51.100.1)---Internet---(Gi0/0 198.51.100.2)HQSteps
- 1.Step 1: On Remote router, enter global configuration mode: configure terminal
- 2.Step 2: Create tunnel interface: interface Tunnel0
- 3.Step 3: Set tunnel source to physical interface: tunnel source GigabitEthernet0/0
- 4.Step 4: Set tunnel destination to HQ's public IP: tunnel destination 198.51.100.2
- 5.Step 5: Configure IPsec protection: tunnel mode ipsec ipv4
- 6.Step 6: Assign IP to tunnel: ip address 192.168.100.1 255.255.255.252
- 7.Step 7: Configure crypto map and ISAKMP policy (not shown for brevity).
! Remote router configuration interface Tunnel0 ip address 192.168.100.1 255.255.255.252 tunnel source GigabitEthernet0/0 tunnel destination 198.51.100.2 tunnel mode ipsec ipv4 ! ! HQ router configuration interface Tunnel0 ip address 192.168.100.2 255.255.255.252 tunnel source GigabitEthernet0/0 tunnel destination 198.51.100.1 tunnel mode ipsec ipv4
Verify: Use 'show crypto ipsec sa' to verify IPsec security associations. Use 'ping 192.168.100.2' from Remote to test tunnel.
Watch out: If the physical interface goes down, the tunnel goes down. Using a loopback as source is more resilient.
Troubleshooting with This Command
When troubleshooting tunnel issues, the 'tunnel source' command is often the first place to check. A healthy tunnel interface should show 'up/up' in 'show ip interface brief'. If the tunnel is down, the most common cause is an incorrect or unreachable tunnel source.
Use 'show interface tunnel <number>' to see the tunnel source and destination. The output includes 'Tunnel source' and 'Tunnel destination' lines. If the source interface is down, the tunnel will be down.
Verify that the source interface has an IP address and is operational. Use 'show ip interface <source-interface>' to confirm the IP address and status. Another common symptom is that the tunnel is up but traffic is not passing.
In that case, check routing: the tunnel destination must be reachable via the source interface. Use 'ping <tunnel-destination>' sourced from the tunnel source IP to test reachability. For example, 'ping 203.0.113.2 source 10.1.1.1'.
If the ping fails, there is a routing issue. Also check that the tunnel mode matches on both ends. Use 'show running-config interface tunnel <number>' to verify the configuration.
If the tunnel source is an IP address, ensure it is configured on the router. A common mistake is using an IP that belongs to a different interface. Use 'show ip interface brief' to list all IPs.
For IPsec tunnels, additionally check crypto maps and ISAKMP policies. The 'debug tunnel' command can be used to see tunnel events, but use with caution in production. Correlate 'show ip route' to ensure the tunnel destination is reachable.
If the tunnel source is a loopback, ensure the loopback is advertised via routing protocols. The step-by-step diagnostic flow: 1) Check tunnel interface status. 2) Verify tunnel source and destination in running config. 3) Check source interface status and IP. 4) Ping tunnel destination from source. 5) Check routing for destination. 6) Verify tunnel mode matches. 7) For IPsec, check crypto SAs. This systematic approach isolates the issue quickly.
CCNA Exam Tips
CCNA exam tip: The tunnel source must be an IP that is reachable from the remote tunnel destination; often a loopback is used for stability.
CCNA exam tip: If you specify an interface, the router uses the primary IP of that interface; if the interface goes down, the tunnel goes down.
CCNA exam tip: You cannot use the same tunnel source for multiple tunnels unless they have different destinations.
CCNA exam tip: The tunnel source command is configured in interface configuration mode for the tunnel interface.
Common Mistakes
Mistake 1: Using an unreachable or non-existent IP as the tunnel source, causing the tunnel to never come up.
Mistake 2: Forgetting to configure the tunnel destination, which is required for point-to-point tunnels.
Mistake 3: Setting the tunnel source to an interface that is down or has no IP address, resulting in tunnel failure.
tunnel source [intf|ip] vs tunnel destination [ip]
Both tunnel source and tunnel destination are essential for establishing a point-to-point tunnel interface in Cisco IOS, but they serve complementary roles: one specifies the local endpoint, the other the remote endpoint. They are often confused because both must be configured for the tunnel to function, and misconfiguration can lead to connectivity issues.
| Aspect | tunnel source [intf|ip] | tunnel destination [ip] |
|---|---|---|
| Scope | Defines local source of tunnel packets | Defines remote destination of tunnel packets |
| Configuration mode | Interface configuration mode for the tunnel interface | Interface configuration mode for the tunnel interface |
| Persistence | Persists in running-config; can be interface or IP | Persists in running-config; static IP address required |
| Precedence | Must be configured before tunnel destination for some encapsulations | Typically configured after tunnel source |
| Typical use | Used to specify the interface or IP that tunnel packets originate from | Used to specify the remote endpoint IP address for the tunnel |
Use tunnel source [intf|ip] when you need to define the local endpoint of the tunnel, ensuring the tunnel interface has a valid source address for outgoing encapsulated packets.
Use tunnel destination [ip] when you need to specify the remote endpoint IP address to which encapsulated packets are sent, establishing the other side of the point-to-point tunnel.
Platform Notes
In IOS-XE, the 'tunnel source' command syntax is identical to classic IOS. However, IOS-XE supports additional tunnel modes like 'tunnel mode ipsec ipv4' and 'tunnel mode gre multipoint' for DMVPN. The output of 'show interface tunnel' may include additional fields like 'Tunnel protocol/transport'.
In NX-OS, the equivalent command is 'source' under interface tunnel configuration, e.g., 'interface tunnel0; source loopback0'. NX-OS also uses 'destination' for the remote endpoint. The syntax is slightly different: 'source <interface|ip>' and 'destination <ip>'.
On ASA firewalls, tunnel interfaces are configured differently using 'interface tunnel <number>' and 'ip address', but the source is set via 'tunnel-source' command in the tunnel-group configuration, not directly on the interface. For example, 'tunnel-group <name> type ipsec-l2l; tunnel-source <ip>'. In IOS-XR, the command is 'tunnel source' under interface configuration, similar to IOS, but the interface naming convention differs (e.g., 'GigabitEthernet0/0/0/0').
The behavior is consistent across versions 12.x, 15.x, and 16.x, though newer versions may support additional options like 'tunnel source dynamic' for DHCP-assigned IPs. Always verify the specific IOS version documentation for any deprecated or new parameters.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions