Traditional GRE Over IPSEC (CIDR block to CIDR Block) (1)

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/05062443b-0.png "title =" GRE Over ipsec ).png "/>

GRE Over IPSec, as the name suggests, is to establish a GRE tunnel on the IPSec interface, while an IPSec Encryption mode is tunnel mode to encrypt the network segment to the network segment ), this is the GRE tunnel built on the IPSec encrypted CIDR block.

======================================== R0 Configuration: ============================================

Crypto isakmp policy 1 // IPSec Phase 1 parameter configuration

Hash md5

Authentication pre-share

Group 2

Lifectime 3600

Crypto isakmp key 1234 address 192.168.8.1 // configure the first-stage pre-shared key of IPSec

!

!

Crypto ipsec transform-set 1 esp-3des esp-md5-hmac // configure an IPSec second-stage Encryption Policy

!

Crypto map 1 1 ipsec-isakmp // configure the IPSec second-stage map

Set peer 192.168.8.1

Set transform-set 1

Set pfs group2

Match address greoveripsec // configure the stream of interest to the IPSec

!

Interface Loopback1

Ip address 192.168.88.1 255.255.255.0 // R0 loopback interface, used for creating IPSEC-interest streams

!

Interface Tunnel1 // configure the GRE Tunnel

Ip address 192.168.10.1 255.255.255.0 // configure the GRE tunnel Interface

Tunnel source 192.168.88.1 // configure the GRE tunnel address to use the IPSec address)

Tunnel destination 192.168.99.1 // configure the peer address of the GRE tunnel using the IPSec remote address)

!

Interface Serial1/0 // configure the physical interface of R0

Ip address 192.168.1.1 255.255.255.0

Serial restart-delay 0

Crypto map 1 // map 1 is applied to the physical interface

!

Ip access-list extended greoveripsec // configure the stream of interest

Permit ip 192.168.88.0 0.0.255 192.168.99.0 0.0.0.255

Router # show ip route // R0 route

C 192.168.88.0/24 is directly connected, Loopback1

C 192.168.10.0/24 is directly connected, Tunnel1

C 192.168.1.0/24 is directly connected, Serial1/0

S * 0.0.0.0/0 is directly connected, Serial1/0

========================================================== ========================================================== ==================

================================================== R2 Configuration: ============================================

Crypto isakmp policy 1 // IPSec Phase 1 parameter configuration

Hash md5

Authentication pre-share

Group 2

Lifectime 3600

Crypto isakmp key 1234 address 192.168.1.1 // configure the first-stage pre-shared key of IPSec

!

!

Crypto ipsec transform-set 1 esp-3des esp-md5-hmac // configure an IPSec second-stage Encryption Policy

!

Crypto map 1 1 ipsec-isakmp // configure the IPSec second-stage map

Set peer 192.168.1.1

Set transform-set 1

Set pfs group2

Match address greoveripsec // configure the stream of interest to the IPSec

!

Interface Loopback1

The loopback interface of ip address 192.168.999.1 255.255.255.0 // R2. It is used to establish an IPSEC-interest stream.

!

Interface Tunnel1 // configure the GRE Tunnel

Ip address 192.168.10.1 255.255.255.0 // configure the GRE tunnel Interface

Tunnel source 192.168.99.1 // configure the GRE tunnel address to use the IPSec address)

Tunnel destination 192.168.88.1 // configure the peer address of the GRE tunnel using the IPSec remote address)

!

Interface Serial1/0 // configure the physical interface of R0

Ip address 192.168.8.1 255.255.255.0

Serial restart-delay 0

Crypto map 1 // map 1 is applied to the physical interface

!

Ip access-list extended greoveripsec // configure the stream of interest

Permit ip 192.168.99.0 0.0.255 192.168.88.0 0.0.255

Router # show ip route // R2 route

C 192.168.88.0/24 is directly connected, Loopback1

C 192.168.10.0/24 is directly connected, Tunnel1

C 192.168.1.0/24 is directly connected, Serial1/0

S * 0.0.0.0/0 is directly connected, Serial1/0

========================================================== ========================================================== ==================

After parameters are configured on the R0 and R2 routers, the two routers do not actively establish a connection with each other; in this case, Run "ping 192.168.99.1 source 192.168.88.1" on vror0 R0 to actively initiate an IPSec connection. You can also run "ping 192.168.88.1 source 192.168.99.1" on R2 to actively initiate a connection.) from the ping results, an IPSec connection is established between R0 and R2:

Router # ping 192.168.99.1 source 192.168.88.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.99.1, timeout is 2 seconds:

Packet sent with a source address of 192.168.88.1

.!!!! // The first packet loss is used for arp parsing.

Success rate is 80 percent (4/5), round-trip min/avg/max = 64/84/100 MS

At this step, we have established an IPsec connection between R0 and R2. Next, we will establish a GRE tunnel on ipsec. For specific parameter configurations, see the above configurations of R0 and R1, I will not go into details here.

After configuring the tunnel parameters, we will check again whether the tunnel is successfully established and run "ping 192.168.10.2" on R0 "):

Router # ping 192.168.10.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.10.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 64/105/172 MS

From the ping packet above, we can see that the tunnel between R0 and R2. on the gre tunnel, we can run dynamic routes and other data packets that cannot be run on ipsec.

In the future, we will provide gre over ipsec in the form of site-to-site ipsec.

This article is from the "Online Learning recording" blog. For more information, contact the author!