explanation of IPSec gre tunnel

I've been doing some tests with love tunnels and adding encryption ipsec for them so I can route my phones voip through the tunnels.  I found something interesting and looking for an explanation as to why this is.

I have 3 sites which one is considered to be the Center and two other sites considered sticks.  I create the following configurations on all three routers:

crypto ISAKMP policy 5

aes 128 encryption

preshared authentication

Group 2

key encryption isakmp XXXX address 0.0.0.0 0.0.0.0

Crypto ipsec transform-set strong esp - aes esp-sha-hmac

Crypto ipsec profile support

define the transform-set

then, under the tunnel interface, I apply the following command:

protection profile medium ipsec tunnel

With this config the first tunnel between the hub and the spokes 1 arrives without problems, but the router speaks 2 will never establish a tunnel.

What I discovered is if I change this command on all three routers all tunnels are up and everything works but why?

key encryption isakmp XXXX address 0.0.0.0 0.0.0.0 no.-xauth

Why adding the xauth No. allows all tunnels to establish connectivity?

What exactly does the n °-xauth didn't and adding it a risk to safety?

Thanks for any input.

Hello

The keyword "no x-auth" says the router not try extended authentication for VPN tunnels.

Scope of authentication (username and password) is used only when you connect the VPN clients. If you have VPN clients and dynamic keys configured on the router you need to add the keyword "no x-auth" at the end of these lines so that it does not seek to authenticate the routers using a user/pass combination.

The key word is there for this reason specific, and you do not add a security risk by adding it.

HTH.

Raga

Tags: Cisco Security

Similar Questions

  • Problem with IPSec GRE tunnel

    Hello, I have a radio link with a branch, but the link to the provider is not approved to set up a Tunnel GRE + IPSec, but I get that this log in my router.

    % CRYPTO-4-PKT_REPLAY_ERR: decrypt: re-read the verification failed

    The topology is:

    Router 1 C3825 IOS 12.4 (25f) Fa0/2/2 - link radio - router 2 C3825 IOS 15.1 (4) M4 Gi0/1

    I get the logs into the Router 1 only.

    Configurations are:

    Router 1:

    crypto ISAKMP policy 1

    BA aes

    md5 hash

    preshared authentication

    Group 2

    ISAKMP crypto key Andina12 address 172.20.127.114

    invalid-spi-recovery crypto ISAKMP

    !

    !

    Crypto ipsec transform-set TS aes - esp esp-md5-hmac

    !

    Profile of crypto ipsec protected-gre

    86400 seconds, life of security association set

    game of transformation-TS

    interface Tunnel0

    Description IPSec Tunnel of GRE a Víbora

    bandwidth 2000

    IP 172.20.127.117 255.255.255.252

    IP 1400 MTU

    IP tcp adjust-mss 1360

    tunnel source 172.20.127.113

    tunnel destination 172.20.127.114

    protection ipsec profile protected-gre tunnel

    interface FastEthernet0/2/2

    Description RadioEnlace a Víbora

    switchport access vlan 74

    bandwidth 2000

    No cdp enable

    interface Vlan74

    bandwidth 2000

    IP 172.20.127.113 255.255.255.252

    Router eigrp 1

    network 172.20.127.116 0.0.0.3

    Router 2:

    crypto ISAKMP policy 1

    BA aes

    md5 hash

    preshared authentication

    Group 2

    ISAKMP crypto key Andina12 address 172.20.127.113

    !

    !

    Crypto ipsec transform-set TS aes - esp esp-md5-hmac

    !

    Profile of crypto ipsec protected-gre

    86400 seconds, life of security association set

    game of transformation-TS

    interface Tunnel0

    Description IPSec Tunnel of GRE a CSZ

    bandwidth 2000

    IP 172.20.127.118 255.255.255.252

    IP 1400 MTU

    IP tcp adjust-mss 1360

    tunnel source 172.20.127.114

    tunnel destination 172.20.127.113

    protection ipsec profile protected-gre tunnel

    interface GigabitEthernet0/1

    Description Radio Enlace a CSZ

    bandwidth 2000

    IP 172.20.127.114 255.255.255.252

    automatic duplex

    automatic speed

    media type rj45

    No cdp enable

    Router eigrp 1

    network 172.20.127.116 0.0.0.3

    Thanks for the help.

    Yes, you can have just as configured:

    Crypto ipsec transform-set esp - aes TS

    transport mode

    Be sure to change it on both routers.

  • Problem of IPSEC GRE tunnel

    Hello cracks!

    I configured a tunnel of ipsec between 2 sites with free will and ospf.

    The tunnel is up successfully and routes to ospf are correct and I ping at all sites, but http applications works very well.

    The first thing I it was an MTU problem.

    I started to do ping to a remote host with DF bit increase the size of the package to get the classic message, This is the necessary fragment

    but when I did a ping with 1400 f I ask expire.

    What could be the problem? It is the configuration of the tunnel.

    The tunnel is established between the 2 internet lines (10 MB and 30 MB)...

    Thank you very much...

    interface Tunnel0

    Description $FW_INSIDE$

    IP 10.29.0.9 255.255.255.252

    IP access-group 103 to

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP ospf cost 150

    source of tunnel GigabitEthernet0/1

    tunnel destination publicip

    !

    Tunnel1 interface

    IP 10.29.0.5 255.255.255.252

    IP access-group 103 to

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP mtu 1420

    IP ospf cost 150

    source of tunnel GigabitEthernet0/1

    tunnel destination publicip

    Albert,

    Say 'he' doesn't work is no help :-)

    As I said, it's time to take a trace of sniffer ideally on both sides to compare what is happening, not to guess what you're fixing - diagnose.

    M.

  • GRE tunnels will not come on VPN IPsec/GRE

    Hi all

    We have 400 + remote sites that connect to our central location (and a backup site) using Cisco routers with vpn IPSec/GRE tunnels.  We use a basic model for the creation of tunnels, so there is very little chance of a bad configuration on each router.  Remote sites use Cisco 831 s, central sites use Cisco 2821 s.  There is a site where the tunnels WILL refuse just to come.

    Routers are able to ping their public IP addresses, so it is not a routing problem, but gre endpoints cannot ping.  There is no NATing involved, two routers directly accessing the Internet.  The assorded display orders seem to indicate that the SAs are properly built, but newspapers, it seems that last part just don't is finished, and the GRE tunnels come not only upward.

    The attached log file, it seems that both its IPSEC & ISAKMP are created @ 00:25:14, then QM_PHASE2 end @ 00:25:15.

    00:25:15: ISAKMP: (0:10:HW:2): node error 1891573546 FALSE reason for deletion "(wait) QM.
    00:25:15: ISAKMP: (0:10:HW:2): entrance, node 1891573546 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    00:25:15: ISAKMP: (0:10:HW:2): former State = new State IKE_QM_R_QM2 = IKE_QM_PHASE2_COMPLETE
    00:25:15: ISAKMP (0:268435467): received 208.XX packet. Dport 500 sport Global 500 (I) QM_IDLE yy.11
       
    00:25:15: IPSEC (key_engine): had an event of the queue with 1 kei messages
    00:25:15: IPSEC (key_engine_enable_outbound): rec would prevent ISAKMP
    00:25:15: IPSEC (key_engine_enable_outbound): select SA with spinnaker 1572231461/50
    00:25:15: ISAKMP: (0:11:HW:2): error in node-1931380074 FALSE reason for deletion "(wait) QM.
    00:25:15: ISAKMP: (0:11:HW:2): entrance, node-1931380074 = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    00:25:15: ISAKMP: (0:11:HW:2): former State = new State IKE_QM_R_QM2 = IKE_QM_PHASE2_COMPLETE
    00:25:15: IPSEC (key_engine): had an event of the queue with 1 kei messages
    00:25:15: IPSEC (key_engine_enable_outbound): rec would prevent ISAKMP
    00:25:15: IPSEC (key_engine_enable_outbound): select SA with spinnaker 310818168/50

    I don't have the remote router log file, and is very long, so I joined her.  Before that I captured the log file, I enabled debugging ipsec & isakmp and immediately authorized the SAs.

    Assorted useful details and matching orders of show results:

    Cisco IOS Software, C831 (C831-K9O3SY6-M), Version 12.4 (25), RELEASE SOFTWARE (fc1)

    There are 2 connections of IPSEC/GRE tunnel:

    Tunnel101: KC (208.YY. ZZ.11) - remote control (74.WW. XX.35)
    Tunnel201: Dallas (208.XX. YY.11) - remote control (74.WW. XX.35)

    Site-382-831 #sho ip int br
    Interface IP-Address OK? Method State Protocol
    FastEthernet1 unassigned YES unset down down
    FastEthernet2 unassigned YES unset upward, upward
    FastEthernet3 unassigned YES unset upward, upward
    FastEthernet4 unassigned YES unset upward, upward
    Ethernet0 10.3.82.10 YES NVRAM up up
    Ethernet1 74.WW. XX.35 YES NVRAM up up
    Ethernet2 172.16.1.10 YES NVRAM up up
    Tunnel101 1.3.82.46 YES NVRAM up toward the bottom<>
    Tunnel201 1.3.82.62 YES NVRAM up toward the bottom<====  ="">
    NVI0 unassigned don't unset upward upwards

    Site-382-831 #.
    Site-382-831 #sho run int tunnel101
    Building configuration...

    Current configuration: 277 bytes
    !
    interface Tunnel101
    Description % connected to the 2nd KC BGP 2821 - PRI - B
    IP 1.3.82.46 255.255.255.252
    IP mtu 1500
    IP virtual-reassembly
    IP tcp adjust-mss 1360
    KeepAlive 3 3
    source of tunnel Ethernet1
    destination of the 208.YY tunnel. ZZ.11
    end

    Site-382-831 #.

    Site-382-831 #show isakmp crypto his
    status of DST CBC State conn-id slot
    208.XX. YY.11 74.WW. XX.35 QM_IDLE ASSETS 0 11
    208.YY. ZZ.11 74.WW. XX.35 QM_IDLE 10 0 ACTIVE
    Site-382-831 #.

    Site-382-831 #.
    Site-382-831 #show detail of the crypto isakmp
    Code: C - IKE configuration mode, D - Dead Peer Detection
    NAT-traversal - KeepAlive, N - K
    X - IKE extended authentication
    PSK - GIPR pre-shared key - RSA signature
    renc - RSA encryption

    C - id Local Remote I have VRF status BA hash Auth DH lifetime limit.
    11 74.WW. XX.35 208.XX. YY.11 ACTIVE 3des sha psk 1 23:56:09
    Connection-id: motor-id = 11:2 (hardware)
    74.WW 10. XX.35 208.YY. ZZ.11 ACTIVE 3des sha psk 1 23:56:09
    Connection-id: motor-id = 10:2 (hardware)
    Site-382-831 #.

    Site-382-831 #.
    Site-382-831 #show crypto ipsec his

    Interface: Ethernet1
    Tag crypto map: IPVPN_MAP, local addr 74.WW. XX.35

    protégé of the vrf: (none)
    ident (addr, mask, prot, port) local: (74.WW. XX.35/255.255.255.255/47/0)
    Remote ident (addr, mask, prot, port): (208.YY. ZZ.11/255.255.255.255/47/0)
    current_peer 208.YY. ZZ.11 port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: 2333, #pkts encrypt: 2333, #pkts digest: 2333
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    #send 21, #recv errors 0

    local crypto endpt. : 74.WW. XX.35, remote Start crypto. : 208.YY. ZZ.11
    Path mtu 1500, mtu 1500 ip, ip mtu IDB Ethernet1
    current outbound SPI: 0x45047D1D (1157922077)

    SAS of the esp on arrival:
    SPI: 0x15B97AEA (364477162)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2004, flow_id: C83X_MBRD:4, crypto card: IPVPN_MAP
    calendar of his: service life remaining (k/s) key: (4486831/1056)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:
    SPI: 0x45047D1D (1157922077)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2003, flow_id: C83X_MBRD:3, crypto card: IPVPN_MAP
    calendar of his: service life remaining (k/s) key: (4486744/1056)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    outgoing ah sas:

    outgoing CFP sas:

    protégé of the vrf: (none)
    ident (addr, mask, prot, port) local: (74.WW. XX.35/255.255.255.255/47/0)
    Remote ident (addr, mask, prot, port): (208.XX. YY.11/255.255.255.255/47/0)
    current_peer 208.XX. YY.11 port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: 2333, #pkts encrypt: 2333, #pkts digest: 2333
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    #send 21, #recv errors 0

    local crypto endpt. : 74.WW. XX.35, remote Start crypto. : 208.XX. YY.11
    Path mtu 1500, mtu 1500 ip, ip mtu IDB Ethernet1
    current outbound SPI: 0xE82A86BC (3895101116)

    SAS of the esp on arrival:
    SPI: 0x539697CA (1402378186)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2008, flow_id: C83X_MBRD:8, crypto card: IPVPN_MAP
    calendar of his: service life remaining (k/s) key: (4432595/1039)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:
    SPI: 0xE82A86BC (3895101116)
    transform: esp-3des esp-sha-hmac.
    running parameters = {Tunnel}
    Conn ID: 2001, flow_id: C83X_MBRD:1, crypto card: IPVPN_MAP
    calendar of his: service life remaining (k/s) key: (4432508/1039)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    outgoing ah sas:

    outgoing CFP sas:
    Site-382-831 #.

    Site-382-831 #.
    Site-382-831 #show crypto ipsec his | Pkts Inc. | life
    #pkts program: 2397, #pkts encrypt: 2397, #pkts digest: 2397
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    calendar of his: service life remaining (k/s) key: (4486831/862)
    calendar of his: service life remaining (k/s) key: (4486738/862)
    #pkts program: 2397, #pkts encrypt: 2397, #pkts digest: 2397
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    calendar of his: service life remaining (k/s) key: (4432595/846)
    calendar of his: service life remaining (k/s) key: (4432501/846)
    Site-382-831 #.

    Site-382-831 #.
    Site-382-831 #show crypto isakmp policy

    World IKE policy
    Priority protection Suite 10
    encryption algorithm: three key triple a
    hash algorithm: Secure Hash Standard
    authentication method: pre-shared Key
    Diffie-Hellman group: #1 (768 bits)
    lifetime: 86400 seconds, no volume limit
    Default protection suite
    encryption algorithm: - Data Encryption STANDARD (56-bit keys).
    hash algorithm: Secure Hash Standard
    authentication method: Rivest-Shamir-Adleman Signature
    Diffie-Hellman group: #1 (768 bits)
    lifetime: 86400 seconds, no volume limit
    Site-382-831 #.

    Site-382-831 #show crypto card
    "IPVPN_MAP" 101-isakmp ipsec crypto map
    Description: at the 2nd KC BGP 2821 - PRI - B
    Peer = 208.YY. ZZ.11
    Extend the PRI - B IP access list
    access list PRI - B allowed will host 74.WW. XX.35 the host 208.YY. ZZ.11
    Current counterpart: 208.YY. ZZ.11
    Life safety association: 4608000 Kbytes / 3600 seconds
    PFS (Y/N): N
    Transform sets = {}
    IPVPN,
    }

    "IPVPN_MAP" 201-isakmp ipsec crypto map
    Description: 2nd Dallas BGP 2821 - s-B
    Peer = 208.XX. YY.11
    Expand the list of IP SEC-B access
    s - B allowed will host 74.WW access list. XX.35 the host 208.XX. YY.11
    Current counterpart: 208.XX. YY.11
    Life safety association: 4608000 Kbytes / 3600 seconds
    PFS (Y/N): N
    Transform sets = {}
    IPVPN,
    }
    Interfaces using crypto card IPVPN_MAP:
    Ethernet1
    Site-382-831 #.

    Tunnel between KC & the remote site configuration is:

    Distance c831 - KC

    crypto ISAKMP policy 10
    BA 3des
    preshared authentication
    !
    PRI-B-382 address 208.YY isakmp encryption key. ZZ.11
    !
    Crypto ipsec transform-set esp-3des esp-sha-hmac IPVPN
    transport mode
    !
    IPVPN_MAP 101 ipsec-isakmp crypto map
    Description of 2nd KC BGP 2821 - PRI - B
    set of peer 208.YY. ZZ.11
    game of transformation-IPVPN
    match address PRI - B
    !
    interface Tunnel101
    Description % connected to the 2nd KC BGP 2821 - PRI - B
    IP 1.3.82.46 255.255.255.252
    IP mtu 1500
    KeepAlive 3 3
    IP virtual-reassembly
    IP tcp adjust-mss 1360
    source of tunnel Ethernet1
    destination of the 208.YY tunnel. ZZ.11
    !
    interface Ethernet0
    private network Description
    IP 10.3.82.10 255.255.255.0
    IP mtu 1500
    no downtime
    !
    interface Ethernet1
    IP 74.WW. XX.35 255.255.255.248
    IP mtu 1500
    automatic duplex
    IP virtual-reassembly
    card crypto IPVPN_MAP
    no downtime
    !
    PRI - B extended IP access list
    allow accord 74.WW the host. XX.35 the host 208.YY. ZZ.11
    !

    KC-2821 *.

    PRI-B-382 address 74.WW isakmp encryption key. XX.35
    !
    PRI-B-382 extended IP access list
    allow accord 208.YY the host. ZZ.11 the host 74.WW. XX.35
    !
    IPVPN_MAP 382 ipsec-isakmp crypto map
    Description % connected to the 2nd KC BGP 2821
    set of peer 74.WW. XX.35
    game of transformation-IPVPN
    match address PRI-B-382
    !
    interface Tunnel382
    Description %.
    IP 1.3.82.45 255.255.255.252
    KeepAlive 3 3
    IP virtual-reassembly
    IP tcp adjust-mss 1360
    IP 1400 MTU
    delay of 40000
    tunnel of 208.YY origin. ZZ.11
    destination of the 74.WW tunnel. XX.35
    !
    end

    Any help would be much appreciated!

    Mark

    Hello

    logs on Site-382-831, only see the crypt but none decrypts, could you check a corresponding entry on the peer and see if has any questions send return traffic?

    Site-382-831 #show crypto ipsec his | Pkts Inc. | life
    #pkts program: 2397, #pkts encrypt: 2397, #pkts digest: 2397
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    calendar of his: service life remaining (k/s) key: (4486831/862)
    calendar of his: service life remaining (k/s) key: (4486738/862)
    #pkts program: 2397, #pkts encrypt: 2397, #pkts digest: 2397
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    calendar of his: service life remaining (k/s) key: (4432595/846)
    calendar of his: service life remaining (k/s) key: (4432501/846)
    Site-382-831 #.

    Kind regards

    Averroès.

  • basic configuration question IPSec GRE

    the Sub test config has been entered at R1 (router left mostly). R4 has a similar to the inverse IP address config. R1 is able to ping R4 loopback at the present time.

    crypto ISAKMP policy 10
    BA aes
    preshared authentication
    Group 2
    life 120
    address of cisco crypto isakmp 203.115.34.4 keys
    !
    !
    Crypto ipsec transform-set MY_TRANSFORM ah-sha-hmac esp - aes
    !
    MY_MAP 10 ipsec-isakmp crypto map
    defined by peer 203.115.34.4
    game of transformation-MY_TRANSFORM
    match address 100
    !
    !
    !
    !
    interface Loopback0
    192.168.10.1 IP address 255.255.255.255
    !
    interface Tunnel0
    IP 192.168.14.1 255.255.255.0
    source of tunnel Serial1/2
    tunnel destination 203.115.34.4
    card crypto MY_MAP

    !

    !
    interface Serial1/2
    IP 203.115.12.1 255.255.255.0
    series 0 restart delay
    !
    !
    Router eigrp 100
    network 192.168.0.0 0.0.255.255
    Auto-resume
    !
    router ospf 100
    router ID 1.1.1.1
    Log-adjacency-changes
    network 203.115.0.0 0.0.255.255 area 0
    !

    !

    access-list 100 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255 connect

    !

    !

    I see cisco samples configurations include an access list entry as follows...

    access-list 100 permit gre 203.115.12.1 host 203.115.34.4

    I understand the purpose of the ACL above regarding the test configuration that I posted here.

    Let me explain.

    LAN - router - WAN - router - LAN

    Communication between the two LANs can be on a GRE tunnel to an IPsec tunnel or IPsec/GRE tunnel.

    If you simply want to communicate between them unicast IP traffic, IPsec is recommended because it will encrypt the traffic.

    If you need non-unicast or non - IP traffic through, then you can create a GRE tunnel.

    If you want IPsec encryption for the GRE tunnel and then configure IPsec/GRE.

    The ACL you mention will not work because the GRE traffic is only between tunnel endpoints.

    The traffic that flows between local networks is the IP (not the GRE traffic) traffic where a permit GRE ACL will not work.

    It will be useful.

    Federico.

  • Tunnel VPN IPSEC Gre of the router in the branch office by Pix to the router HQ

    Hi all

    I tried to get this scenario to work before I put implement but am getting the error on router B.

    01:05:38: % CRYPTO-6-IKMP_MODE_FAILURE: fast processing mode failed with the peer to 83.1.16.1

    Here are the following details for networks

    Router B

    Address series 82.12.45.1/30

    fast ethernet 192.168.20.1/24 address

    PIX

    outside the 83.1.16.1/30 interface eth0

    inside 192.168.50.1/30 eth1 interface

    Router

    Fast ethernet (with Pix) 192.168.50.2/30 address

    Loopback (A network) 192.168.100.1/24 address

    Loopback (Network B) 192.168.200.1/24 address

    Loopback (Network C) 192.168.300.1/24 address

    Is could someone please tell me where im going wrong as I read the explanation of the error and it points to political unmaching. This has confused me like the two counterparts seem to have the same settings.

    Config router B

    ======================

    name of host B
    !
    Select the 5 secret goat.
    !
    username 7 privilege 15 password badger badger
    iomem 15 memory size
    IP subnet zero
    !
    !
    no ip domain-lookup
    IP - test.local domain name
    !
    property intellectual ssh delay 30
    property intellectual ssh authentication-2 retries
    !
    crypto ISAKMP policy 5
    md5 hash
    preshared authentication
    Group 2
    ISAKMP crypto key VPN2VPN address 83.1.16.1
    !
    86400 seconds, duration of life crypto ipsec security association
    !
    Crypto ipsec transform-set esp - esp-md5-hmac VPN
    !
    crypto map 5 VPN ipsec-isakmp
    defined by peer 83.1.16.1
    PFS group2 Set
    match address VPN
    !
    call the rsvp-sync
    !
    interface Loopback10
    20.0.2.2 the IP 255.255.255.255
    !
    interface Tunnel0
    bandwidth 1544000
    20.0.0.1 IP address 255.255.255.0
    source of Loopback10 tunnel
    tunnel destination 20.0.2.1
    !
    interface FastEthernet0/0
    Description * inside the LAN CONNECTION *.
    address 192.168.20.1 255.255.255.0
    IP nat inside
    automatic duplex
    automatic speed
    !
    interface Serial0/0
    Description * INTERNET ACCESS *.
    IP 88.12.45.1 255.255.255.252
    NAT outside IP
    VPN crypto card
    !
    interface FastEthernet0/1
    no ip address
    Shutdown
    automatic duplex
    automatic speed
    !
    Router eigrp 1
    network 20.0.0.0
    No Auto-resume
    !
    overload of IP nat inside source list NAT interface Serial0/0
    IP classless
    IP route 0.0.0.0 0.0.0.0 Serial0/0
    no ip address of the http server
    !
    !
    NAT extended IP access list
    deny ip 192.168.20.0 0.0.0.255 192.168.200.0 0.0.0.255
    deny ip 192.168.20.0 0.0.0.255 192.168.300.0 0.0.0.255
    deny ip 192.168.20.0 0.0.0.255 192.168.100.0 0.0.0.255
    ip licensing 192.168.20.0 0.0.0.255 any
    list of IP - VPN access scope
    permit ip host 20.0.2.2 20.0.2.1
    !

    Config PIX

    ====================

    PIX Version 7.2 (4)
    !
    pixfirewall hostname
    names of
    name 20.0.2.2 B_LOOP
    name 88.12.45.1 B_WANIP
    !
    interface Ethernet0
    Description * LINK to ISP *.
    nameif outside
    security-level 0
    IP 83.1.16.1 255.255.255.252
    !
    interface Ethernet1
    Description * LINK TO LAN *.
    nameif inside
    security-level 100
    IP 192.168.50.1 255.255.255.252
    !
    passive FTP mode
    the ROUTER_LOOPS object-group network
    network-object 20.0.2.0 255.255.255.252
    access allowed extended VPN ip host 20.0.2.1 B_LOOP list
    access-list extended SHEEP permit ip host 20.0.2.1 ROUTER_LOOPS object-group
    Access ip allowed any one extended list ACL_OUT
    pager lines 24
    Outside 1500 MTU
    Within 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Global (1 interface external)
    NAT (inside) 0 access-list SHEEP
    NAT (inside) 1 192.168.50.0 255.255.255.252
    NAT (inside) 1 192.168.50.0 255.255.255.0
    Access to the interface inside group ACL_OUT
    Route outside 0.0.0.0 0.0.0.0 83.1.16.2 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp - esp-md5-hmac VPN
    86400 seconds, duration of life crypto ipsec security association
    VPN 5 crypto card matches the VPN address
    card crypto VPN 5 set pfs
    card crypto VPN 5 set peer B_WANIP
    VPN 5 value transform-set VPN crypto card
    card crypto VPN 5 defined security-association life seconds 28800
    card crypto VPN outside interface
    crypto isakmp identity address
    crypto ISAKMP allow outside
    crypto ISAKMP policy 5
    preshared authentication
    the Encryption
    md5 hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    tunnel-group 88.12.45.1 type ipsec-l2l
    IPSec-attributes tunnel-group 88.12.45.1
    pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !

    When you create a GRE tunnel between two routers, there should be a routing decision to reach the Remote LAN through local (rather than exit directly the physical interface) tunnel interface.

    This could be accomplished by EIGRP, but you can check if the adjacency is built.

    As a test, what happens if you add a static route saying (reach remote LAN, sending traffic to the tunnel interface).

    Check if the GRE tunnel comes up with sh interface tunnel

    Federico.

  • GRE and IPSEC VPN tunnel over the same interface

    My client is currently connected to a service provider of call through a GRE Tunnel over IPSEC. They chose to move all connections to a VPN site-to-site traditional behind a firewall, here, to your corp office.  As the questions says, is possible for me to put in place the VPN site to site on the same router? Interface Tunnelx both ethernet have the same encryption card assigned to the destination router.  I thought that traffic could divide by identification of traffic 'interesting '.  Thanks for all the ideas, suggestions

    Ray

    Ray

    Thanks for the additional information. It takes so that the existing entries in ACL 101 remain so the existing tunnel will still work. And you have to add entries that will allow the new tunnel. Editing an ACL that is actively filtering traffic can get complicated. Here is a technique that I use sometimes.

    -create a new access list (perhaps ACL 102 assuming that 102 is not already in use).

    -Copy the entries of ACL 101 to 102 and add additional entries you need in places appropriate in the ACL.

    -Once the new version of the ACL is complete in the config, then go tho the interface and change the ip access-group to point to the new ACL.

    This provides a transition that does not affect traffic. And he made it back to the original easy - especially if something does not work as expected in the new ACL.

    If the encryption of the remote card has an entry for GRE and a separate entrance for the IPSec which is a good thing and should work. I guess card crypto for GRE entry specifies an access list that allows the GRE traffic and for IPSec crypto map entry points to a different access list that identifies the IP traffic is encrypted through the IPSec tunnel.

    HTH

    Rick

  • IGP and GRE Tunnel

    Please see the photo above two connected sites using FA 0/1 R1 and R2 and a GRE Tunnel is formed.

    Case 1:

    We have a point-to-point connection between two routers and the IP address assigned to FA 0/1 on R1 and R2 belong to the same subnet. We then configure a GRE Tunnel on these as indicated in the topology:

    • Using such as eigrp and ospf IGP we can peer routers R1 and R2 using the tunnel and the point-to-point connections.
    • This will make the redundant paths between two routers
    • This will form the double equal relationship between the two routers (for example for EIGRP or OSPF).
    • Or we can tunnel just for the exchange of traffic between two routers.

    My Question:

    1. What is the standard in this topology using the two connection for iGP peering or just tunnel in the real world?
    2. What is the standard in this topology using the two connection for iGP peering or tunnel just in a review?

    Case 2:

    If Fa 0/1 on both routers is all public IPs and in fact do not belong to the same subnet. So I think that we have to create a Tunnel between the two routers and then use the tunnel both routers for iGP peer.

    My Question:

    • I just want to know there is a valid case and also do we get this case in a review?

    What comments can you do on both cases freely, I just create these two cases to clear my mind.

    Basically the tunnel's link to Point Virtual Point between two routers. When you have two router physically connected by Point to point the link for this tunnel has no utility, but if you have two routers separate my many network jumps then GRE and IPsec tunnel is useful, and in this case tunnel gives you the ease of the logical Point to Point network.

    In the tunnel you can run any routing protocol ospf, eigrp, BGP route smiler or Sttic as interface point-to-point between two routers.

    Answer to your question on my opinion are as below

    case 1

    1. What is the standard in this topology using the two connection for iGP peering or just tunnel in the real world? -No use of the tunnel in this case in the real world so he will use any routing protocol between physical point-to-point interface.
    2. What is the standard in this topology using the two connection for iGP peering or tunnel just in a review? -Same as above point Exam are mostly due to the scenario of the real world (not sure what you're talking about what exam).

    Case 2

    • I just want to know there is a valid case and also do we get this case in a review? -Yes, this is valid in the real world, but also optical examination specially DMVPN and Ipsec tunnel in the CCIE exam.

    Please always evaluate the useful post!

    Kind regards

    Pawan (CCIE # 52104)

  • DMVPN/IPSEC, GRE and IPSEC Multi Point

    Hi all

    I have a project of construction of 50 locations connectivity to my data center 2. Each location has Internet with router 877 with image dry.

    my DC has 1900 router. Now I want what tunnel I go with. DMVPN IPSEC or IPSEC GRE.

    The data will come from DC locations only. No inter connections location. I want to know the pros and cons as well as any change of required equipment.

    Kind regards

    Satya.M

    Given your criteria, I would say THAT DMVPN would be best suited

    Cisco - Configuration dynamic Multipoint Virtual Private Networks DMVPN

    Implementation in DMVPN GDOI

    Pete

  • Questions about the Internet browsing GRE tunnel ISPec

    I am faced with Internet navigation problems when distened to the customer's internet traffic. mail.Yahoo.com does not open on the client, while yahoo.com works very well. Same streaming and apps from apple works does not on iphone, but distened for data center traffic works very well. If I remove the protection of IPSec of GRE tunnel then everything works fine.

    Please guide what to do, I have attached a diagram of scenario

    Hello

    It is difficult to suggest, but MTU issue could be the reason for the problem.

    Do you have the command of setting-mss tcp ip on both interfaces of tunnel?

    If not, please try to add:

    Tunnel X interface

    IP tcp adjust-mss 1300

    If it helps, you can try to increase the value of 1300 to 1360 MMS (which is recommended by Cisco)

  • Significant decline in performance on the GRE tunnel after using cryptographic protection

    Hi all

    I have two G1 RSR (1811 and 1812) who have a GRE tunnel between them.

    Without any encryption protection I received about 3.6 MB/s in regular transfers of Windows SMB. After using cryptographic protection of the tunnel I'm now only 2.7 MB/s transfers of same.

    No idea as to why this is?

    My conclusions:
    According to this http://www.cisco.com/web/partners/downloads/765/tools/quickreference/vpn... the AES crypto fixed return of the 1800s is 40 MB/s.
    The increase in overhead of cryptographic protection shouldn't be the problem I tried to test the transfers on the tunnel without protection and 'ip tcp adjust-mss 800' of the tunnel. There was only a small performance drop here, not as much as with the crypto.
    I tried several sets of cryptographic transformation, they all give the same performance as long as they are made in the material.
    ISAKMP is always done in the software? I can't get it to show its is done at the hardware level, regardless of isakmp policy.

    IP MTU on both interfaces of tunnel are 1434 with cryptographic protection.

    My config:

    crypto ISAKMP policy 10
    BA aes 256
    sha512 hash
    preshared authentication
    Group 20
    isakmp encryption key * address *.
    !
    Crypto ipsec transform-set ESP-AES256-SHA esp - aes 256 esp-sha-hmac
    transport mode
    !
    Profile of crypto ipsec VPN
    game of transformation-ESP-AES256-SHA
    !
    Tunnel10
    IP 10.251.251.1 255.255.255.0
    no ip redirection
    no ip proxy-arp
    load-interval 30
    source of tunnel FastEthernet0
    tunnel destination *.
    tunnel path-mtu-discovery
    Tunnel VPN ipsec protection profile
    !

    Output:

    ISR1811 #sh crypto ipsec his
    Interface: Tunnel10
    Tag crypto map: addr Tunnel10-head-0, local *.

    protégé of the vrf: (none)
    ident (addr, mask, prot, port) local: (* / 255.255.255.255/47/0)
    Remote ident (addr, mask, prot, port): (* / 255.255.255.255/47/0)
    current_peer * port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: 683060, #pkts encrypt: 683060, #pkts digest: 683060
    #pkts decaps: 1227247, #pkts decrypt: 1227247, #pkts check: 1227247
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    Errors #send 0, #recv 0 errors

    endpt local crypto. : *, remote Start crypto. : ***
    Path mtu 1500, mtu 1500 ip, ip mtu IDB FastEthernet0
    current outbound SPI: 0x8D9A911E (2375717150)
    PFS (Y/N): N, Diffie-Hellman group: no

    SAS of the esp on arrival:
    SPI: 0xD6F42959 (3606325593)
    transform: aes-256-esp esp-sha-hmac.
    running parameters = {Transport}
    Conn ID: 45, flow_id: VPN on board: 45, sibling_flags 80000006, crypto card: head-Tunnel10-0
    calendar of his: service life remaining (k/s) key: (4563208/1061)
    Size IV: 16 bytes
    support for replay detection: Y
    Status: ACTIVE

    the arrival ah sas:
    SAS of the CFP on arrival:

    outgoing esp sas:
    SPI: 0x8D9A911E (2375717150)
    transform: aes-256-esp esp-sha-hmac.
    running parameters = {Transport}
    Conn ID: 46, flow_id: VPN on board: 46, sibling_flags 80000006, crypto card: head-Tunnel10-0
    calendar of his: service life remaining (k/s) key: (4563239/1061)
    Size IV: 16 bytes
    support for replay detection: Y
    Status: ACTIVE

    outgoing ah sas:
    outgoing CFP sas:

    ISR1811 #show in detail his crypto isakmp
    Code: C - IKE configuration mode, D - Dead Peer Detection
    NAT-traversal - KeepAlive, N - K
    T - cTCP encapsulation, X - IKE Extended Authentication
    PSK - GIPR pre-shared key - RSA signature
    renc - RSA encryption
    IPv4 Crypto ISAKMP Security Association

    C - id Local Remote I have VRF status BA hash Auth DH lifetime limit.
    2015 * * ACTIVE aes sha5 psk 20 12:42:50
    Engine-id: Conn-id = SW: 15
    2016 * * ACTIVE aes sha5 psk 20 12:42:58
    Engine-id: Conn-id = SW: 16
    IPv6 Crypto ISAKMP Security Association

    Use of CPU for the transfer with crypto:

    ISR1811 #sh proc cpu its

    ISR1811 09:19:54 Tuesday Sep 2 2014 THIS

    544444555555555544444444445555544444555556666644444555555555
    355555000001111133333888884444444444333333333377777666662222
    100
    90
    80
    70
    60                                          *****     *****
    50 ****************     **********     ************************
    40 ************************************************************
    30 ************************************************************
    20 ************************************************************
    10 ************************************************************
    0... 5... 1... 1... 2... 2... 3... 3... 4... 4... 5... 5... 6
    0 5 0 5 0 5 0 5 0 5 0
    Processor: % per second (last 60 seconds)

    ISR1812 #sh proc cpu history

    ISR1812, Tuesday 09:19:24 Sep 2 2014 THIS

    666666666666666666666666666666666666666666655555444445555544
    777888883333344444555555555566666777770000055555777776666666
    100
    90
    80
    70 ********          ********************
    60 ************************************************     *****
    50 ************************************************************
    40 ************************************************************
    30 ************************************************************
    20 ************************************************************
    10 ************************************************************
    0... 5... 1... 1... 2... 2... 3... 3... 4... 4... 5... 5... 6
    0 5 0 5 0 5 0 5 0 5 0
    Processor: % per second (last 60 seconds)

    I think that this performance is what you should get with the legacy 18xx SRI G1. But the performance degradation is perhaps really a little too high.

    For ISAKMP, there is no problem with that. The amount of protected data is too small to have one any influence.

    As a first test, I would remove the GRE encapsulation by setting "mode ipsec ipv4 tunnel" on the tunnel interface and compare if the results improve.

  • Configuration of Site VPN connection to another via GRE Tunnels

    I am trying to connect VPN site to site on the internet using GRE tunnels. I am able to reach from a WAN interface to another. But I am not able to get the ISAKMP and IPSec to work. Below the configuration and a simplified below flowchart. In the scenario below, I am also running BGP between these routers. The BGP neighbor-ships are trained through the tunnels. But I want traffic between tunnels to encrypt. IPsec and ISAKMP not running BGP routes and other traffic is not encrypted.

    This is why I would like to know what could the reason for this.

    Router config VPN 1

     crypto isakmp policy 1 encr 3des authentication pre-share group 2 lifetime 500 crypto isakmp key test_key1 address 192.168.30.1 crypto isakmp key test_key1 address 192.168.30.2 crypto isakmp keepalive 60 20 crypto isakmp aggressive-mode disable ! ! crypto ipsec transform-set high esp-3des esp-sha-hmac mode tunnel ! ! ! crypto map CRYP_MAP_IPSEC 10 ipsec-isakmp set peer 192.168.20.1 set security-association lifetime seconds 4000 set transform-set high set pfs group2 match address 110 crypto map CRYP_MAP_IPSEC 20 ipsec-isakmp set peer 192.168.20.2 set security-association lifetime seconds 4000 set transform-set high set pfs group2 match address 111 ! interface Loopback0 description IPsec_Tunnel0 ip address 192.168.30.1 255.255.255.255 ! interface Loopback1 description IPsec_Tunnel1 ip address 192.168.30.2 255.255.255.255 ! interface Loopback2 description BGP_Peer1 ip address 192.168.40.1 255.255.255.255 ! interface Loopback3 description BGP_Peer2 ip address 192.168.40.2 255.255.255.255 ! interface Tunnel0 ip unnumbered Loopback0 tunnel source Loopback0 tunnel destination 192.168.20.1 crypto map CRYP_MAP_IPSEC ! interface Tunnel1 ip unnumbered Loopback1 tunnel source Loopback1 tunnel destination 192.168.20.2 crypto map CRYP_MAP_IPSEC ! interface gi0 description #### CONNECTED TO Internet #### ip address 10.1.1.1 255.255.255.252 ip access-group 100 in duplex auto speed auto ! router bgp 64851 bgp log-neighbor-changes neighbor BGP_PEER_1 peer-group neighbor BGP_PEER_1 remote-as 64859 neighbor BGP_PEER_1 ebgp-multihop 255 neighbor BGP_PEER_1 update-source Loopback2 neighbor BGP_PEER_1 version 4 neighbor BGP_PEER_1 next-hop-self neighbor BGP_PEER_2 peer-group neighbor BGP_PEER_2 remote-as 64859 neighbor BGP_PEER_2 ebgp-multihop 255 neighbor BGP_PEER_2 update-source Loopback3 neighbor BGP_PEER_2 version 4 neighbor BGP_PEER_2 next-hop-self neighbor 192.168.10.1 peer-group BGP_PEER_1 neighbor 192.168.10.2 peer-group BGP_PEER_2 ! ip route 192.168.10.1 255.255.255.255 Tunnel0 ip route 192.168.10.2 255.255.255.255 Tunnel1 ip route 192.168.20.1 255.255.255.255 GigabitEthernet0 ip route 192.168.20.2 255.255.255.255 GigabitEthernet0 ! access-list 100 permit ip any any access-list 110 permit gre host 192.168.30.1 host 192.168.20.1 access-list 110 permit gre host 192.168.20.1 host 192.168.30.1 access-list 111 permit gre host 192.168.30.2 host 192.168.20.2 access-list 111 permit gre host 192.168.20.2 host 192.168.30.2 ======================================================================

    Router config VPN 2

     crypto isakmp policy 1 encr 3des authentication pre-share group 2 lifetime 500 crypto isakmp key test_key1 address 192.168.30.1 crypto isakmp key test_key1 address 192.168.30.2 crypto isakmp keepalive 60 20 crypto isakmp aggressive-mode disable ! ! crypto ipsec transform-set high esp-3des esp-sha-hmac mode tunnel ! ! ! crypto map CRYP_MAP_IPSEC 10 ipsec-isakmp set peer 192.168.30.1 set security-association lifetime seconds 4000 set transform-set high set pfs group2 match address 110 crypto map CRYP_MAP_IPSEC 20 ipsec-isakmp set peer 192.168.30.2 set security-association lifetime seconds 4000 set transform-set high set pfs group2 match address 111 ! interface Loopback0 description IPsec_Tunnel0 ip address 192.168.20.1 255.255.255.255 ! interface Loopback1 description IPsec_Tunnel1 ip address 192.168.20.2 255.255.255.255 ! interface Loopback2 description BGP_Peer1 ip address 192.168.10.1 255.255.255.255 ! interface Loopback3 description BGP_Peer2 ip address 192.168.10.2 255.255.255.255 ! interface Tunnel0 ip unnumbered Loopback0 tunnel source Loopback0 tunnel destination 192.168.30.1 crypto map CRYP_MAP_IPSEC ! interface Tunnel1 ip unnumbered Loopback1 tunnel source Loopback1 tunnel destination 192.168.30.2 crypto map CRYP_MAP_IPSEC ! interface gi0 description #### CONNECTED TO Internet #### ip address 10.1.1.2 255.255.255.252 ip access-group 100 in duplex auto speed auto ! router bgp 64859 bgp log-neighbor-changes neighbor BGP_PEER_1 peer-group neighbor BGP_PEER_1 remote-as 64851 neighbor BGP_PEER_1 ebgp-multihop 255 neighbor BGP_PEER_1 update-source Loopback2 neighbor BGP_PEER_1 version 4 neighbor BGP_PEER_1 next-hop-self neighbor BGP_PEER_2 peer-group neighbor BGP_PEER_2 remote-as 64851 neighbor BGP_PEER_2 ebgp-multihop 255 neighbor BGP_PEER_2 update-source Loopback3 neighbor BGP_PEER_2 version 4 neighbor BGP_PEER_2 next-hop-self neighbor 192.168.40.1 peer-group BGP_PEER_1 neighbor 192.168.40.2 peer-group BGP_PEER_2 ! ip route 192.168.40.1 255.255.255.255 Tunnel0 ip route 192.168.40.2 255.255.255.255 Tunnel1 ip route 192.168.30.1 255.255.255.255 gi0 ip route 192.168.30.2 255.255.255.255 gi0 ! access-list 100 permit ip any any access-list 110 permit gre host 192.168.20.1 host 192.168.30.1 access-list 110 permit gre host 192.168.30.1 host 192.168.20.1 access-list 111 permit gre host 192.168.20.2 host 192.168.30.2 access-list 111 permit gre host 192.168.30.2 host 192.168.20.2 ======================================================================

    Encryption of your Tunnel configuration is incorrect... you need to do something about the following at both ends.

    crypto ISAKMP policy 10
    aes encryption
    sha hash
    preshared authentication
    Group 5
     
    cisco crypto isakmp key address
     
    Crypto ipsec transform-set esp - aes 256 esp-sha-hmac RIGHT
     
    Profile of crypto ipsec MYPROFILE
    transformation-RIGHT game
     
    interface tunnel 10
    Unnumbered IP gig0/0
    tunnel source gig0/0
    tunnel destination
    ipv4 ipsec tunnel mode
    Profile of tunnel MYPROFILE ipsec protection
     

    --

    Please do not forget to select a correct answer and rate useful posts

  • An interface of multipoint GRE tunnel on two physical interfaces?

    Hi all

    I use DMVPN double single cloud VPN network of hubs.

    Our shelves (C831 SRI) are connected to the dynamic DHCP ISP and dynamic PPPoE ISP.  I want to install a temporary kit that fits anywhere.  Here is the configuration of my my ISP PPPoE tunnel:

    interface Tunnel0
    bandwidth 1000
    IP 172.23.2.254 255.255.252.0
    no ip redirection
    IP mtu 1436
    property intellectual PNDH authentication xxxxxx
    map of PNDH 172.16.0.1 IP 230.2.2.1

    map of PNDH IP multicast 230.2.2.1
    map of PNDH 172.16.0.2 IP 230.2.2.2
    map of PNDH IP multicast 230.2.2.1
    PNDH id network IP-900001
    property intellectual PNDH holdtime 300
    property intellectual PNDH nhs 172.16.0.1
    property intellectual PNDH nhs 172.16.0.2
    delay of 1000
    source of Dialer1 tunnel
    multipoint gre tunnel mode
    tunnel key xxxxxx
    Tunnel MyIPSecProf ipsec protection profile

    For my ISP DHCP, I only change the Ethernet1 tunnel source.

    Is it possible to configure tunnel interfaces different related 2 on 2 physical interfaces (like: 1 Ethernet1 and 1 in Dialer1).  The challenge is that I can not change the configuration of hubs at all.  So I can't put the ip address of the tunnel in 2 different subnet.  There is only 1 tunnel on the hub interface

    Someone has an idea?

    Thank you very much

    Yes, I see it now. Unnumbered IP will provide the interface to the MTR and tunnel interface you have is point-to-multipoint. I'm afraid that there is no good solution to your needs.

    Kind regards

    Lei Tian

  • GRE tunnel

    Hi - I'm trying to understand how the network described in the configuration http://pastebin.com/fM40vxcG is structured. I'm fighting for work on how I am connected to 10.144.254.1 before building a gre tunnel by using the node as a tunnel destination. Thank you very much

    concerning

    Vladimir

    Hello Vladimir,.

    I checked your link.

    I was you I wouldn't stick my Pwd VPN on a public forum, which is not really sure (unless you used a collar). If this isn't the case, you can edit your post and point to another link with pw stripped and can change the public ip addresses as well.

    Regarding your configuration, you have an encryption card configured with an ACL that match the tunnel.

    So in the end, your GRE tunnel using the private IP address is encapsulated in an IPSEC Tunnel using public IPS (see set crypto map peer): then you have a tunnel tunnel.

    I can't tell you the object of this since I do not know your topology.

    Hope this helps,

    Bastien.

  • question of LAN IPSec/gre

    Hi guys,.

    I'm trying to connect 2 1841 routers using ipsec/gre.

    the situation is as below:

    router a router - Internet - b

    router config:

    crypto ISAKMP policy 1
    BA 3des
    preshared authentication
    Group 2
    ISAKMP crypto key cisco address bb.bb.bb.bb

    Crypto ipsec transform-set esp-3des esp-md5-hmac TFMset
    !
    Profile of crypto ipsec ToB
    game of transformation-TFMset

    !

    interface Tunnel0
    Description * to B *.
    IP 100.100.100.1 255.255.255.252
    tunnel source aa.aa.aa.aa
    destination bb.bb.bb.bb tunnel
    ipv4 ipsec tunnel mode
    Profile of tunnel ToB ipsec protection

    interface FastEthernet0/0
    IP address aa.aa.aa.aa 255.255.255.252
    NAT outside IP
    !
    interface FastEthernet0/1
    11.11.11.11 IP address 255.255.255.0
    IP nat inside

    IP route 0.0.0.0 0.0.0.0 FastEthernet0/0

    IP nat inside source map route SHEEP interface FastEthernet0/0 overload

    IPNAT extended IP access list
    deny ip 11.11.11.0 0.0.0.255 22.22.22.0 0.0.0.255
    IP 11.11.11.0 allow 0.0.0.255 any
    !
    SHEEP allowed 10 route map
    corresponds to the IP IPNAT

    Config router B:

    crypto ISAKMP policy 1
    BA 3des
    preshared authentication
    Group 2
    ISAKMP crypto key cisco address aa.aa.aa.aa

    Crypto ipsec transform-set esp-3des esp-md5-hmac TFMset
    !
    Profile of crypto ipsec ToA
    game of transformation-TFMset

    !

    interface Tunnel0
    Description * to A *.
    IP 100.100.100.1 255.255.255.252
    tunnel source bb.bb.bb.bb
    destination aa.aa.aa.aa tunnel
    ipv4 ipsec tunnel mode
    Profile of tunnel ToA ipsec protection

    interface FastEthernet0/0
    IP address bb.bb.bb.bb 255.255.255.252
    NAT outside IP
    !
    interface FastEthernet0/1
    IP 22.22.22.22 255.255.255.0
    IP nat inside

    IP route 0.0.0.0 0.0.0.0 FastEthernet0/0

    IP nat inside source map route SHEEP interface FastEthernet0/0 overload

    IPNAT extended IP access list

    deny ip 22.22.22.0 0.0.0.255 11.11.11.0 0.0.0.255

    IP 22.22.22.0 allow 0.0.0.255 any

    !

    SHEEP allowed 10 route map

    corresponds to the IP IPNAT

    I managed to see the crypto isakmp and tunnel upward, but I'm not able to ping to the Remote LAN ip...

    have you guys any idea on this?

    Thank you...

    Hello

    Try to create a static route on a router for remote network pointing to the source of the tunnel as its front door.

    Here is a useful link: -.

    https://learningnetwork.Cisco.com/docs/doc-2457

    Thank you

    Shilpa

Maybe you are looking for