Link Search Menu Expand Document

Tunnels Template

NOTE: If you are deploying an SD-WAN network, the Business Intent Overlays (BIOs) govern tunnel properties. In this case, you do not need this template.

If you are not creating overlays, use this template to assign and manage tunnel properties.

  • Tunnel templates can be applied to any appliances (with or without tunnels). However, only existing tunnels can accept the template settings. To enable an appliance to apply these same settings to future tunnels, select Make these the Defaults for New Tunnels.

  • To view, edit, and delete tunnels, use the Tunnels tab. The Mode selected determines the tabs that display.


Tunnels Template Settings

Field Description
Mode Indicates whether the tunnel protocol is udp, gre, or ipsec.
Admin state Indicates whether the tunnel has been set to admin Up or Down.
Auto discover MTU enabled Allows an appliance to determine the best MTU to use.
Auto max BW enabled When enabled, allows the appliances to auto-negotiate the maximum tunnel bandwidth.
DSCP Determines the DSCP marking that the keep-alive messages should use.
Fastfail Thresholds When multiple tunnels are carrying data between two appliances, this feature determines how quickly to disqualify a tunnel from carrying data.

The Fastfail connectivity detection algorithm for the wait time from receipt of last packet before declaring a brownout is:

Twait = Base + N * RTTavg

where Base is a value in milliseconds, and N is the multiplier of the average Round Trip Time over the past minute. For example, if:

Base = 200mS
N = 2


RTTavg = 50mS

The appliance declares a tunnel to be in brownout if it does not see a reply packet from the remote end within 300mS of receiving the most recent packet.

In the Tunnel Advanced Options, Base is expressed as Fastfail wait-time base offset (ms), and N is expressed as Fastfail RTT multiplication factor.

Fastfail enabled – This option is triggered when a tunnel’s keepalive signal does not receive a reply. The options are disable, enable, and continuous. If the disqualified tunnel subsequently receives a keepalive reply, its recovery is instantaneous.

If set to disable, keepalives are sent every second, and 30 seconds elapse before failover. In that time, all transmitted data is lost.

If set to enable, keepalives are sent every second, and a missed reply increases the rate at which keepalives are sent from one per second to ten per second. Failover occurs after one second.

When set to continuous, keepalives are continuously sent at ten per second. Therefore, failover occurs after one tenth of a second.

Thresholds for Latency, Loss, or Jitter are checked once every second.

Receiving three successive measurements in a row that exceed the threshold puts the tunnel into a brownout situation and flows will attempt to fail over to another tunnel within the next 100mS.

Receiving three successive measurements in a row that drop below the threshold will drop the tunnel out of brownout.
FEC (Forward Error Correction) can be set to enable, disable, or auto.
FEC ratio Is an option when FEC is set to auto that specifies the maximum ratio. The options are 1:2, 1:5, 1:10, or 1:20.
IPSec anti-replay window Provides protection against an attacker duplicating encrypted packets by assigning a unique sequence number to each encrypted packet. The decryptor keeps track of which packets it has seen on the basis of these numbers. The default window size is 64 packets.
IPSec pre-shared key A shared, secret string of Unicode characters that is used for authentication of an IPSec connection between two parties.
Mode Indicates whether the tunnel protocol is udp, gre, or ipsec.
MTU Maximum Transmission Unit (MTU) is the largest possible unit of data that can be sent on a given physical medium. For example, the MTU of Ethernet is 1500 bytes. MTUs up to 9000 bytes are supported. Auto allows the tunnel MTU to be discovered automatically, and it overrides the MTU setting.
Reorder wait Maximum time (in ms) the appliance holds an out-of-order packet when attempting to reorder. The 100ms default value should be adequate for most situations. FEC can introduce out-of-order packets if the reorder wait time is not set high enough.
Retry count Number of failed keep-alive messages that are allowed before the appliance brings the tunnel down.
UDP destination port Used in UDP mode. Accept the default value unless the port is blocked by a firewall.
UDP flows Used in UDP mode. Number of flows over which to distribute tunnel data. Accept the default.

Back to top

© Copyright 2024 Hewlett Packard Enterprise Development LP. The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Aruba Networks and the Aruba logo are registered trademarks of Aruba Networks, Inc. Third-party trademarks mentioned are the property of their respective owners. To view the end-user software agreement, go to HPE Aruba Networking EULA.

Open Source Code:

Hewlett Packard Enterprise Company
Attn: General Counsel
WW Corporate Headquarters
1701 E Mossy Oaks Rd Spring, TX 77389
United States of America