--- title: Running Routing Protocols over Tunnels « ipSpace.net blog description: Running routing protocols over tunnels can cause recursive routing loops — where the tunnel itself becomes the best path to its own endpoint, leading to... canonical: https://daily.dev/posts/running-routing-protocols-over-tunnels-ipspace-net-blog-d43y3pcff twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Running Routing Protocols over Tunnels « ipSpace.net blog | daily.dev og:description: Running routing protocols over tunnels can cause recursive routing loops — where the tunnel itself becomes the best path to its own endpoint, leading to... og:url: https://daily.dev/posts/running-routing-protocols-over-tunnels-ipspace-net-blog-d43y3pcff og:image: https://api.daily.dev/og/posts/d43Y3pCff.png og:image:alt: Running Routing Protocols over Tunnels « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Running Routing Protocols over Tunnels « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 4 min read · 0 upvotes · 0 comments ## Summary Running routing protocols over tunnels can cause recursive routing loops — where the tunnel itself becomes the best path to its own endpoint, leading to infinite encapsulation and network meltdown. The post explains why tunnels exist (traffic engineering, encryption, VPNs), how MPLS/TE avoids this by disabling routing adjacencies over tunnels, the special care needed with IPsec tunnel interfaces, and how VPNs like MPLS/VPN and EVPN cleanly separate customer and transport address spaces using BGP and IGP. For those insisting on IGP-only designs, using two VRFs to isolate customer and transport address spaces prevents recursive routing entirely. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What causes recursive routing when running a routing protocol over a tunnel? Recursive routing occurs when the tunnel itself becomes the best path to its own remote endpoint. If an IGP advertises the tunnel endpoint prefix and the routing protocol selects the tunnel as the best path to reach that endpoint, packets get encapsulated infinitely — each lookup sends traffic back into the tunnel, causing a network meltdown. MPLS/TE avoids this by disabling routing adjacencies over its tunnels entirely. _Network engineers debugging tunnel routing loops find the underlying patterns discussed on daily.dev._ ### How does MPLS/TE prevent recursive routing over tunnels? MPLS/TE prevents recursive routing by disabling routing adjacencies over its tunnel interfaces entirely. The tunnel is a pure data-plane construct. When a link-state protocol installs routes into the RIB/FIB, it rewrites the outgoing interface to the tunnel interface only when the shortest-path tree traverses the tunnel tail-end node — the routing protocol itself never runs over the tunnel. _Engineers designing MPLS traffic engineering architectures track these patterns on daily.dev._ ### How can I run an IGP over a tunnel without causing recursive routing if I don't want to use BGP? Split the customer and transport address spaces into two separate VRFs — one can be the global routing table. This creates two independent IGP instances. Because the tunnel endpoints exist only in the transport VRF and not in the customer VRF, the customer IGP can never select the tunnel as a path to its own endpoint, eliminating recursive routing entirely. _Architects choosing between VRF isolation and BGP-based separation for VPN designs find relevant discussions on daily.dev._ ## Similar posts on daily.dev - [MPLS/VPN with SR-MPLS Core « ipSpace.net blog](https://daily.dev/posts/mpls-vpn-with-sr-mpls-core-ipspace-net-blog-nw3uwiphe) · ipSpace.net Blog · 0 upvotes · 0 comments --- Tags: [#vpn](https://daily.dev/tags/vpn), [#bgp](https://daily.dev/tags/bgp) [View this post on daily.dev](https://daily.dev/posts/running-routing-protocols-over-tunnels-ipspace-net-blog-d43y3pcff) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Running Routing Protocols over Tunnels « ipSpace.net blog","url":"https://daily.dev/posts/running-routing-protocols-over-tunnels-ipspace-net-blog-d43y3pcff","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/running-routing-protocols-over-tunnels-ipspace-net-blog-d43y3pcff"},"datePublished":"2026-08-11T08:51:47.414Z","dateModified":"2026-08-11T08:53:44.474Z","description":"Running routing protocols over tunnels can cause recursive routing loops — where the tunnel itself becomes the best path to its own endpoint, leading to...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/running-routing-protocols-over-tunnels-ipspace-net-blog-d43y3pcff","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"vpn,bgp","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Running Routing Protocols over Tunnels « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/running-routing-protocols-over-tunnels-ipspace-net-blog-d43y3pcff#faq","mainEntity":[{"@type":"Question","name":"What causes recursive routing when running a routing protocol over a tunnel?","acceptedAnswer":{"@type":"Answer","text":"Recursive routing occurs when the tunnel itself becomes the best path to its own remote endpoint. If an IGP advertises the tunnel endpoint prefix and the routing protocol selects the tunnel as the best path to reach that endpoint, packets get encapsulated infinitely — each lookup sends traffic back into the tunnel, causing a network meltdown. MPLS/TE avoids this by disabling routing adjacencies over its tunnels entirely. Network engineers debugging tunnel routing loops find the underlying patterns discussed on daily.dev."}},{"@type":"Question","name":"How does MPLS/TE prevent recursive routing over tunnels?","acceptedAnswer":{"@type":"Answer","text":"MPLS/TE prevents recursive routing by disabling routing adjacencies over its tunnel interfaces entirely. The tunnel is a pure data-plane construct. When a link-state protocol installs routes into the RIB/FIB, it rewrites the outgoing interface to the tunnel interface only when the shortest-path tree traverses the tunnel tail-end node — the routing protocol itself never runs over the tunnel. Engineers designing MPLS traffic engineering architectures track these patterns on daily.dev."}},{"@type":"Question","name":"How can I run an IGP over a tunnel without causing recursive routing if I don't want to use BGP?","acceptedAnswer":{"@type":"Answer","text":"Split the customer and transport address spaces into two separate VRFs — one can be the global routing table. This creates two independent IGP instances. Because the tunnel endpoints exist only in the transport VRF and not in the customer VRF, the customer IGP can never select the tunnel as a path to its own endpoint, eliminating recursive routing entirely. Architects choosing between VRF isolation and BGP-based separation for VPN designs find relevant discussions on daily.dev."}}]} ```