Traditional GRE Over IPSEC (CIDR block to CIDR Block) (1)

Source: Internet
Author: User
Tags hmac

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/05062443b-0.png "title =" GRE Over ipsec ).png "/>


GRE Over IPSec, as the name suggests, is to establish a GRE tunnel on the IPSec interface, while an IPSec Encryption mode is tunnel mode to encrypt the network segment to the network segment ), this is the GRE tunnel built on the IPSec encrypted CIDR block.


======================================== R0 Configuration: ============================================

Crypto isakmp policy 1 // IPSec Phase 1 parameter configuration

Hash md5

Authentication pre-share

Group 2

Lifectime 3600

Crypto isakmp key 1234 address 192.168.8.1 // configure the first-stage pre-shared key of IPSec

!

!

Crypto ipsec transform-set 1 esp-3des esp-md5-hmac // configure an IPSec second-stage Encryption Policy

!

Crypto map 1 1 ipsec-isakmp // configure the IPSec second-stage map

Set peer 192.168.8.1

Set transform-set 1

Set pfs group2

Match address greoveripsec // configure the stream of interest to the IPSec

!

Interface Loopback1

Ip address 192.168.88.1 255.255.255.0 // R0 loopback interface, used for creating IPSEC-interest streams

!

Interface Tunnel1 // configure the GRE Tunnel

Ip address 192.168.10.1 255.255.255.0 // configure the GRE tunnel Interface

Tunnel source 192.168.88.1 // configure the GRE tunnel address to use the IPSec address)

Tunnel destination 192.168.99.1 // configure the peer address of the GRE tunnel using the IPSec remote address)

!

Interface Serial1/0 // configure the physical interface of R0

Ip address 192.168.1.1 255.255.255.0

Serial restart-delay 0

Crypto map 1 // map 1 is applied to the physical interface

!

Ip access-list extended greoveripsec // configure the stream of interest

Permit ip 192.168.88.0 0.0.255 192.168.99.0 0.0.0.255


Router # show ip route // R0 route

C 192.168.88.0/24 is directly connected, Loopback1

C 192.168.10.0/24 is directly connected, Tunnel1

C 192.168.1.0/24 is directly connected, Serial1/0

S * 0.0.0.0/0 is directly connected, Serial1/0

========================================================== ========================================================== ==================


================================================== R2 Configuration: ============================================

Crypto isakmp policy 1 // IPSec Phase 1 parameter configuration

Hash md5

Authentication pre-share

Group 2

Lifectime 3600

Crypto isakmp key 1234 address 192.168.1.1 // configure the first-stage pre-shared key of IPSec

!

!

Crypto ipsec transform-set 1 esp-3des esp-md5-hmac // configure an IPSec second-stage Encryption Policy

!

Crypto map 1 1 ipsec-isakmp // configure the IPSec second-stage map

Set peer 192.168.1.1

Set transform-set 1

Set pfs group2

Match address greoveripsec // configure the stream of interest to the IPSec

!

Interface Loopback1

The loopback interface of ip address 192.168.999.1 255.255.255.0 // R2. It is used to establish an IPSEC-interest stream.

!

Interface Tunnel1 // configure the GRE Tunnel

Ip address 192.168.10.1 255.255.255.0 // configure the GRE tunnel Interface

Tunnel source 192.168.99.1 // configure the GRE tunnel address to use the IPSec address)

Tunnel destination 192.168.88.1 // configure the peer address of the GRE tunnel using the IPSec remote address)

!

Interface Serial1/0 // configure the physical interface of R0

Ip address 192.168.8.1 255.255.255.0

Serial restart-delay 0

Crypto map 1 // map 1 is applied to the physical interface

!

Ip access-list extended greoveripsec // configure the stream of interest

Permit ip 192.168.99.0 0.0.255 192.168.88.0 0.0.255


Router # show ip route // R2 route

C 192.168.88.0/24 is directly connected, Loopback1

C 192.168.10.0/24 is directly connected, Tunnel1

C 192.168.1.0/24 is directly connected, Serial1/0

S * 0.0.0.0/0 is directly connected, Serial1/0

========================================================== ========================================================== ==================


After parameters are configured on the R0 and R2 routers, the two routers do not actively establish a connection with each other; in this case, Run "ping 192.168.99.1 source 192.168.88.1" on vror0 R0 to actively initiate an IPSec connection. You can also run "ping 192.168.88.1 source 192.168.99.1" on R2 to actively initiate a connection.) from the ping results, an IPSec connection is established between R0 and R2:


Router # ping 192.168.99.1 source 192.168.88.1


Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.99.1, timeout is 2 seconds:

Packet sent with a source address of 192.168.88.1

.!!!! // The first packet loss is used for arp parsing.

Success rate is 80 percent (4/5), round-trip min/avg/max = 64/84/100 MS


At this step, we have established an IPsec connection between R0 and R2. Next, we will establish a GRE tunnel on ipsec. For specific parameter configurations, see the above configurations of R0 and R1, I will not go into details here.

After configuring the tunnel parameters, we will check again whether the tunnel is successfully established and run "ping 192.168.10.2" on R0 "):

Router # ping 192.168.10.2


Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.10.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 64/105/172 MS


From the ping packet above, we can see that the tunnel between R0 and R2. on the gre tunnel, we can run dynamic routes and other data packets that cannot be run on ipsec.


In the future, we will provide gre over ipsec in the form of site-to-site ipsec.














This article is from the "Online Learning recording" blog. For more information, contact the author!

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.