5 min read Intermediate 13.9k

Cisco IOS / IOS-XE: eBGP with VeryCloud (AS198825) over GRE tunnel

Published on May 18, 2026 at 04:01 PM

Complete Cisco IOS / IOS-XE configuration: GRE tunnel to VeryCloud PoP, dual-stack eBGP IPv4 + IPv6 sessions, prefix-list, route-map, MD5 security. For ISR, CSR1000v, Catalyst 8000.

Introduction

Cisco IOS remains the reference operator edge-router platform in many networks. Whether you have an ISR 4000, a CSR 1000v virtual on VMware/KVM, a Catalyst 8000 or 8200/8300, the BGP+GRE config is nearly identical. This tutorial gives you the validated skeleton for a VeryCloud Remote Transit IP.

Prerequisites

A Cisco IOS / IOS-XE router with fixed public IP
VeryCloud's technical email with:
- PUB_VC: VeryCloud tunnel endpoint
- 169.254.X.1/30: v4 peer-IP
- 2a0e:XXXX:XXXX::0/127: v6 peer-IP
- MD5_SECRET if MD5 auth chosen
Your ASN (public or private 64512-65534)
Your IPv4 and IPv6 prefixes
Privileged CLI access

Step 1: Backup existing config

enable
copy running-config startup-config
copy startup-config flash:backup-pre-transit.cfg

Step 2: Enable IPv6 routing if not already done

configure terminal
!
ipv6 unicast-routing
ipv6 cef
!
exit

Step 3: Create the GRE Tunnel interface

configure terminal
!
interface Tunnel0
 description "VeryCloud Remote Transit IP - GRE"
 ip address 169.254.X.2 255.255.255.252
 ipv6 address 2a0e:XXXX:XXXX::1/127
 ip mtu 1476
 ip tcp adjust-mss 1436
 ipv6 mtu 1456
 tunnel source GigabitEthernet0/0/0
 tunnel destination PUB_VC
 tunnel mode gre ip
 no shutdown
!
exit

Notes:

tunnel source: your router's outbound interface (preferred over hardcoded IP)
ip mtu 1476: 1500 - 24 (GRE header)
ip tcp adjust-mss 1436: MSS clamping for TCP (1476 - 20 IP - 20 TCP)

Step 4: Test the tunnel

end
show interface Tunnel0
ping 169.254.X.1
ping ipv6 2a0e:XXXX:XXXX::0

Step 5: Static routes for announcement

configure terminal
!
ip route 192.0.2.0 255.255.255.0 Null0
ip route 198.51.100.0 255.255.255.0 Null0
ipv6 route 2001:DB8::/32 Null0
!
exit

Step 6: Prefix-lists for filtering

configure terminal
!
ip prefix-list TO-VC-V4 seq 10 permit 192.0.2.0/24
ip prefix-list TO-VC-V4 seq 20 permit 198.51.100.0/24

ipv6 prefix-list TO-VC-V6 seq 10 permit 2001:DB8::/32

ip prefix-list NO-BOGONS seq 10 deny 0.0.0.0/8 le 32
ip prefix-list NO-BOGONS seq 20 deny 10.0.0.0/8 le 32
ip prefix-list NO-BOGONS seq 30 deny 127.0.0.0/8 le 32
ip prefix-list NO-BOGONS seq 40 deny 169.254.0.0/16 le 32
ip prefix-list NO-BOGONS seq 50 deny 172.16.0.0/12 le 32
ip prefix-list NO-BOGONS seq 60 deny 192.0.2.0/24 le 32
ip prefix-list NO-BOGONS seq 70 deny 192.168.0.0/16 le 32
ip prefix-list NO-BOGONS seq 80 deny 198.18.0.0/15 le 32
ip prefix-list NO-BOGONS seq 100 permit 0.0.0.0/0 le 24

ipv6 prefix-list NO-BOGONS6 seq 10 deny ::/0 ge 49
ipv6 prefix-list NO-BOGONS6 seq 20 permit ::/0 le 48
!
exit

Step 7: Route-maps

configure terminal
!
route-map TO-VC permit 10
 match ip address prefix-list TO-VC-V4
exit

route-map TO-VC6 permit 10
 match ipv6 address prefix-list TO-VC-V6
exit

route-map FROM-VC permit 10
 match ip address prefix-list NO-BOGONS
exit

route-map FROM-VC6 permit 10
 match ipv6 address prefix-list NO-BOGONS6
exit
!
exit

Step 8: Configure eBGP

configure terminal
!
router bgp 65000
 bgp router-id 192.0.2.1
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 timers bgp 30 90
 !
 neighbor 169.254.X.1 remote-as 198825
 neighbor 169.254.X.1 description "VeryCloud Transit v4"
 neighbor 169.254.X.1 password MD5_SECRET
 neighbor 169.254.X.1 ebgp-multihop 2
 !
 neighbor 2a0e:XXXX:XXXX::0 remote-as 198825
 neighbor 2a0e:XXXX:XXXX::0 description "VeryCloud Transit v6"
 neighbor 2a0e:XXXX:XXXX::0 password MD5_SECRET
 neighbor 2a0e:XXXX:XXXX::0 ebgp-multihop 2
 !
 address-family ipv4
  network 192.0.2.0 mask 255.255.255.0
  network 198.51.100.0 mask 255.255.255.0
  neighbor 169.254.X.1 activate
  neighbor 169.254.X.1 soft-reconfiguration inbound
  neighbor 169.254.X.1 route-map FROM-VC in
  neighbor 169.254.X.1 route-map TO-VC out
  neighbor 169.254.X.1 maximum-prefix 5000
 exit-address-family
 !
 address-family ipv6
  network 2001:DB8::/32
  neighbor 2a0e:XXXX:XXXX::0 activate
  neighbor 2a0e:XXXX:XXXX::0 soft-reconfiguration inbound
  neighbor 2a0e:XXXX:XXXX::0 route-map FROM-VC6 in
  neighbor 2a0e:XXXX:XXXX::0 route-map TO-VC6 out
  neighbor 2a0e:XXXX:XXXX::0 maximum-prefix 1000
 exit-address-family
!
exit

Step 9: Save

end
write memory

Step 10: Verify

show ip bgp summary
show bgp ipv6 unicast summary

show ip bgp neighbors 169.254.X.1 received-routes
show ip bgp neighbors 169.254.X.1 advertised-routes
show bgp ipv6 unicast neighbors 2a0e:XXXX:XXXX::0 received-routes

show ip route bgp
show ipv6 route bgp

You should see the default route 0.0.0.0/0 via 169.254.X.1.

Troubleshooting

Neighbor in Idle or Active — tunnel down, ping 169.254.X.1 fails, ACL blocking TCP/179 Established but PfxRcd: 0 — VeryCloud side not announcing, try clear bgp ipv4 unicast 169.254.X.1 soft inYour prefixes not announced — network command without route in RIB; check show ip route 192.0.2.0MD5 auth failed — debug ip bgp 169.254.X.1 shows mismatch; identical password both sides Hold time expired — unstable tunnel (MTU/PMTU); verify ip mtu and ip tcp adjust-mss

Useful commands

show ip bgp summary
show bgp ipv6 unicast summary
show ip bgp neighbors 169.254.X.1
show ip bgp 0.0.0.0/0
show ip route bgp
show interface Tunnel0

clear bgp ipv4 unicast 169.254.X.1 soft in
clear ip bgp 169.254.X.1

debug ip bgp 169.254.X.1
undebug all

Conclusion

Cisco IOS + GRE tunnel + eBGP = the classic Remote Transit IP combo. The config fits in ~100 clean lines. The pitfalls are MTU/MSS, ebgp-multihop, and MD5. Follow this skeleton and you're up in under an hour.

Going further: BFD for sub-second failover, BGP communities for traffic engineering, RPKI via Cisco RPKI server, multi-PoP redundancy with 2 tunnels.