Terminate Transport Tunnels

About this task

Perform this procedure to terminate GRE, nvGRE, VXLAN, IPIP, or GTPu packet headers from incoming packets.

Procedure

Create a transport tunnel with the required parameters.

device (config) # transport-tunnel name
tunnel-type [ gre | erspan ] [ src-ip ipaddr | mask mask ] [tunnel-id value ]

Create an ingress-group with the required parameters.
```
device (config) # ingress-group name
```
Configure the required ingress-group traffic-type parameters for traffic classification:
- To configure the traffic-type and mode, go to step 4.
- To configure the traffic-type with the IP address to be matched, go to step 5.
- To configure the VXLAN outermost header with the IP address in double encapsulation traffic, go to step 6.
Configure the required traffic-type parameter and mode for the ingress-group.
- Terminate mode: Decapsulates IPGRE, nvGRE, VXLAN, IPIP, or GTPu packet headers.
- Scope-shift mode: Shifts scope of IPGRE, nvGRE, VXLAN, IPIP, GTPu packets to inner headers.
```
device (config-ingress-group) # traffic-type {gre | gtpu | ipip | nvgre | vxlan} mode [decap | new-scope]
```
- The outer (sap-id) and inner (inner-sap-id) tunnel SAP IDs are generated for tunnel levels one and two.
- If the mode to decapsulate or terminate packet headers is not specified, packets are classified based on configured traffic type and tunnel ID parameters.
Configure the traffic-type with the IP address to be matched for traffic classification.
```
traffic-type { gre | ipip | gtpu | vxlan | nvgre } ip [ src-ip src-mask dst-ip dst-mask ]
```
Configure the VXLAN outermost header with the IP address in double encapsulation traffic.
```
traffic-type vxlan outer ip src-ip src-mask dst-ip dst-mask
```
To configure packet mirroring for VXLAN frames, go to step 7. Otherwise, proceed to step 8.
Optional: Configure packet mirroring for VXLAN frames.
1. Enable mirror configuration.
```
device(config)# mirror mirr_1
device(config-mirror)#
```
2. Configure the mirror destination port in slot/port format.
```
device(config-mirror)# set interface ethernet NAME
```
Attach the ingress group to the required ingress port or interface.
```
device (config-ingress-group)# set ingress-group name
```

Attach the ingress group to the transport tunnel.

device(config)# transport-tunnel name 
device(config-transport-tunnel)# set ingress-group name

Configure L3-ACL to forward the traffic:

Set ACL in the route-map.

Bind route-map to the ingress-group.

device(config)# ip access-list name
device (config)# route-map name sequence_number
device (config-route-map) # match ip name
device (config-route-map-name) # forward-action permit

Configure the required ports, interfaces, or port-channel:
- List of egress ports or interfaces in egress-group and associated group in route-map.
- Egress interface in route-map.
- Port-channel in egress-group and set the group in route-map.
```
device (config) # interface ethernet slot/port 
device (config-if) # set ingress-group ingress-group-name
```