Symptom

An auto-tunnel adjacency in an IWAN router may become corrupted and show as '(incomplete)', halting all traffic forwarding out of the tunnel Router#show adjacency tun0 detail Protocol Interface Address IP Tunnel0 X.X.X.X(634157) (incomplete) <------------------- 0 packets, 0 bytes epoch 0 sourced in sev-epoch 10 punt (rate-limited) packets no src set

Conditions

Workaround

Shutting down and bringing back up the border router will trigger the router to build a new adjacency - domain vrf border shut ... no shut Additionally, the following script can be used to auto-correct this problem in production - event manager applet ADJ event timer watchdog time 60 action 1.0 cli command "enable" action 1.1 cli command "show adjacency tunnel 0 detail | ex 227.0.0.0" action 1.2 string first "(incomplete)" "$_cli_result" action 1.3 if $_string_result ne "-1" action 1.4 syslog msg "Incomplete adjacency found. Gathering data and correcting problem." action 1.5 cli command "config t" action 1.6 cli command "domain iwan" action 1.7 cli command "vrf default" action 1.8 cli command "border" action 1.9 cli command "shut" action 2.0 wait 2 action 2.1 cli command "no shut" action 2.2 mail server "" to "" from "" subject "Incomplete Adjacency Found" action 2.3 syslog msg "The EEM Script has completed." action 2.4 end In the example above, there are a couple of things to note: - The IWAN domain name needs to be updated based on the configured environment. - The auto-tunnel number may vary, depending on what services are configured. This can be checked with the following command: show domain master status This may then need to be modified in the script. - The e-mail option can be removed if this isn't required. - The script runs every minute.

Further Problem Description