AvailabilitySign inBook a DemoJoin Waitlist
Back to Learning
Cisco · SVPNIntermediate

GRE VPN Endpoint Migration

Tunnel0 is up/up on the new circuit and the far site is still unreachable. Find the half of the migration that was missed, live, right below.

Interactive simRoutingGREVPN

Symptom

Cut a live site-to-site GRE tunnel over to new ISP IPs with minimal downtime, keeping DNS, LDAP and web reachable across both sites.

Your mission

Inspect, recover, then verify

Format

Cisco IOS CLI

Start interactive labSee the investigation plan ↓Need a hint? Reveal the root cause ↓
GRE Migration: Tunnel Up, Nothing Crossing It

Investigate before you configure.

Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.

Observe the symptom and link state.

Diagnose by comparing the protocol evidence.

Verify the expected device state and confirm the original symptom is resolved.

Console access: HQ · BRANCH

This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.

Need a hint?

Reveal the root cause when you're ready.

Try the investigation first, then use this as your escape hatch, not a dead end.

Locked

Sign up with your email to open GRE VPN Endpoint Migration, free. You get the root cause and the full step-by-step fix.

No spam. The fix lands in your inbox too. Signing up includes 4 guided labs free, tracked against your email. After that, the Learning Pass unlocks every remaining lab.

Lab debrief

Turn the session into a repeatable troubleshooting pattern.

Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.

The problem

After moving a site-to-site GRE tunnel onto new ISP IPs, the tunnel shows up and you can ping the new endpoint, but the remote site can't reach DNS, LDAP or web, and the routes that used to be learned over the tunnel have disappeared.

What you'll practice

  • Audit a two-site GRE VPN and map service dependencies (DNS, LDAP, web)
  • Migrate tunnel source and destination to new ISP IPs
  • Re-establish the routing adjacency that runs across the tunnel
  • Verify overlay route propagation and tunnel MTU
  • Confirm cross-site service reachability after cutover

The topology

Two sites, Chicago and Austin, each with edge and core routers behind a zone-based firewall, connected across an ISP backbone by a GRE tunnel. Services at each site depend on the tunnel, so a mis-migrated endpoint shows up as broken applications, not just a down interface.

Commands to run yourself

The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.

Confirm the tunnel transport
show interfaces Tunnel0
Check the overlay peering
show ip bgp summary
Compare both ends' neighbor config
show running-config | section router bgp

Topology diagram

Fact-checked references

The commands and behaviour in this lab were checked against these primary references.

Frequently asked

Is the tunnel the problem, or the routing?

That's the lesson: the tunnel line-protocol can come up on the new IPs while the routing that rides over it never re-forms, so services stay dark until you fix the overlay, not the tunnel.

Does this map to SVPN?

Yes. Site-to-site tunnel configuration, migration and troubleshooting are core Cisco Secure VPN (SVPN) topics, exercised here on a real dual-site topology.

Ready to run this lab yourself?

No setup, no image sourcing. Book a session or ask for a live demo.

View availabilityBook a demo