GRE in IPSEC tunnel

Similar Questions

• GRE over IPSec tunnel cannot pass traffic through it

  I am trying to configure a GRE over IPSec tunnel between sites, we use the router cisco 7613 SUP720 (IOS: s72033-advipservicesk9_wan - mz.122 - 18.SXF15a.bin) and 3845 router (IOS:c3845 - advsecurityk9 - mz.124 - 25c.bin), we are facing problems when we use the tunnel because traffic is not passing through it. the configuration was working when we were using two routers cisco 3845 (IOS:c3845 - advsecurityk9 - mz.124 - 25c.bin), but for some reason, it doesn't work anymore when I paste the configuration on the new 7613 router.

  Head office

  crypto ISAKMP policy 10
  BA aes
  preshared authentication
  Group 5
  ISAKMP crypto key T3ST001 address 0.0.0.0 0.0.0.0
  !
  !
  Crypto ipsec transform-set IPSec_PLC aes - esp esp-sha-hmac
  transport mode
  !
  map PLC - CUM 10 ipsec-isakmp crypto
  defined by peer 167.134.216.89
  game of transformation-IPSec_PLC
  match address 100
  !
  !
  !
  Tunnel1 interface
  bandwidth 1984
  IP 167.134.216.94 255.255.255.252
  Mtu 1476 IP
  load-interval 30
  source of tunnel Serial0/1/0:0
  tunnel destination 167.134.216.89

  interface Serial0/1/0:0
  IP 167.134.216.90 255.255.255.252
  card crypto PLC - CUM

  access-list 100 permit gre 167.134.216.90 host 167.134.216.8

  Router eigrp 100
  network 167.134.216.92 0.0.0.3

  Directorate-General of the

  crypto ISAKMP policy 10
  BA aes
  preshared authentication
  Group 5
  ISAKMP crypto key T3ST001 address 0.0.0.0 0.0.0.0
  !
  !
  Crypto ipsec transform-set IPSec_PLC aes - esp esp-sha-hmac
  transport mode
  !
  map PLC - CUM 10 ipsec-isakmp crypto
  defined by peer 167.134.216.90
  game of transformation-IPSec_PLC
  match address 100

  Tunnel1 interface
  bandwidth 1984
  IP 167.134.216.93 255.255.255.252
  Mtu 1476 IP
  load-interval 30
  source of tunnel Serial1/0/0:1
  tunnel destination 167.134.216.90

  interface Serial1/0/0:1
  bandwidth 1984
  IP 167.134.216.89 255.255.255.252
  IP access-group 101 in
  load-interval 30
  no fair queue
  card crypto PLC - CUM

  access-list 100 permit gre 167.134.216.89 host 167.134.216.90

  ER-7600 #sh crypto isakmp his
  conn-id State DST CBC slot
  167.134.216.89 167.134.216.90 QM_IDLE 3 0

  ER-3845 #sh crypto isakmp his
  status of DST CBC State conn-id slot
  167.134.216.89 167.134.216.90 QM_IDLE 3 0 ACTIVE

  ER-3845 #sh active cryptographic engine connections

  Algorithm of address State IP Interface ID encrypt decrypt
  3 Serial0/1/0: 167.134.216.90 0 HMAC_SHA + AES_CBC 0 0 value
  3001 Serial0/1/0: 167.134.216.90 0 set AES + SHA 0 0
  3002 Serial0/1/0: 167.134.216.90 0 set AES + SHA 61 0

  ER-7600 #sh active cryptographic engine connections

  Algorithm of address State IP Interface ID encrypt decrypt
  3 Serial1/0/0:1 167.134.216.89 set HMAC_SHA + AES_CBC 0 0
  2000 Serial1/0/0:1 167.134.216.89 set HMAC_SHA + 0 66 AES_CBC
  2001 Serial1/0/0:1 167.134.216.89 set HMAC_SHA + AES_CBC 0 0

  I had this error on the er-3845: % CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd package not an IPSEC packet and this one on the IPSEC (epa_des_crypt) UH-7600: decrypted packet has no control of his identity

  Please help, it's so frustrating...

  Thanks in advance

  Oscar

  Here is a document from cisco, mentioning clearly for a card encryption on the two physical as tunnel interface well.

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a008009438e.shtml

  It may be useful

  Manish

• Setting KeepAlive on GRE over IPSEC tunnel

  Hello world

  Need to know if there are benefits of the KeepAlive on GRE over IPSEC implementation that goes over the Wan. ?

  We currently have no KeepAlive on GRE tunnel.

  If we config KeepAlive on both ends of the ACCORD it will cause any overload or the CPU load?

  Thank you

  MAhesh

  If you use a routing on the GRE tunnel protocol you should use KeepAlive WILL not, but I would probably recommend use KeepAlive WILL anyway for the following reasons:

  1. the overload caused by the GRE KeepAlive is quite small, it should not affect the ability to pass traffic

  2. If you ever want to use tracking interface for roads or the static routes that you can interface WILL detect it descend as quickly as possible

  I know that your IPSec device is separate, so I'd probably also enable KeepAlive on the IPSec tunnel as well.

• 1841 can route between tunnel GRE and IPSEC tunnel?

  Hello everyone!

  See the image below.

  Main office (10.0.1.0/24 LAN) and branch (10.0.2.0/24 LAN) are connected through the GRE tunnel.

  The third office (10.0.3.0/24) is attached to the second branch via IPSEC.

  Is there the way to establish the connection between the third and the main office through cisco 1841?

  Is it possible to perform routing, perhaps with NAT?

  In fact we need connection with a single server in the main office.

  Thank you

  Hello

  It is possible to build this configuration.

  the IPSEC connection between 10.0.3.x and 10.0.2.x should also encapsulate the traffic to main office.

  Steps to follow:

  Central office, to shift traffic to 10.0.3.x above the GRE tunnel.

  The second part, add the 10.0.3.x - 10.0.1.x selection of traffic to the ACL IPSEC with the third

  The third part, add the 10.0.3.x - 10.0.1.x selection of traffic to the ACL IPSEC with the second pane.

  Please rate if this helped.

  Kind regards

  Daniel

• The GRE and IPSec

  We currently have several sites with ISAKMP/IPSec tunnels between routers 2800 and we need some of them migrate to the GRE with IPSec tunnels. Are there problems with endpoint tunnels GRE and IPsec on the same router and interface?

  I didn't know all the problems - apart from the router doing the encryption/decryption & GRE encapsulation/decapsulation, just be respect for traffic through the put.

  I have noted problems with traffic GRE and MTU problems. Cisco recommends a MTU of 1440 at Discretion, I would say that set 1400.

  HTH

• How to troubleshoot an IPSec tunnel GRE?

  Hello

  My topology includes two firewalls connected through the Internet "" (router) and behind each firewall, there is a router.

  The routers I configured a GRE tunnel that is successful, then I configured an IPsec tunnel on the firewall.

  I does not change the mode to transport mode in the transform-set configuration.

  Everything works; If I connect a PC to the router, it can ping another PC on the other router. However if I change mode of transport mode that they cannot.

  I was wondering how can I ensure that the IPSec tunnel WILL really works? How can I fix it or package tracking?

  Thank you.

  I was wondering how can I ensure that the IPSec tunnel WILL really works? How can I fix it or package tracking?

  To verify that the VPN tunnel works well, check the output of
  ISAKMP crypto to show his
  Crypto ipsec to show his

  Here are the commands of debug
  Debug condition crypto x.x.x.x, where x.x.x.x IP = peer peer
  Debug crypto isakmp 200
  Debug crypto ipsec 200

  You will see ACTIVE int the first output and program non-zero and decaps on the output of the latter.

  For the GRE tunnel.
  check the condition of the tunnel via "int ip see the brief.

  In addition, you can configure keepalive via the command:

  Router # configure terminal
  Router (config) #interface tunnel0
  Router(Config-if) 5 4 #keepalive

  and then run "debug keepalive tunnel" to see packets hello tunnel going and coming from the router.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers

  Hello world

  I am trying to establish a GRE IPsec tunnel between two cisco routers (2620XM and a 836).

  I created a tunnel interfaces on both routers as follows.

  2620XM

  interface Tunnel0

  IP 10.1.5.2 255.255.255.252

  tunnel source x.x.x.x

  tunnel destination y.y.y.y

  end

  836

  interface Tunnel0

  IP 10.1.5.1 255.255.255.252

  tunnel source y.y.y.y

  tunnel destination x.x.x.x

  end

  and configuration of isakmp/ipsec as follows,

  2620XM

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address y.y.y.y no.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_melissia

  !

  myvpn 9 ipsec-isakmp crypto map

  defined peer y.y.y.y

  Set transform-set to_melissia

  match address 101

  2620XM-router #sh ip access list 101

  Expand the access IP 101 list

  10 permit host x.x.x.x y.y.y.y host will

  836

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address x.x.x.x No.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_metamorfosi

  !

  myvpn 10 ipsec-isakmp crypto map

  defined peer x.x.x.x

  Set transform-set to_metamorfosi

  match address 101

  836-router #sh access list 101

  Expand the access IP 101 list

  10 licences will host host x.x.x.x y.y.y.y

  Unfortunately I had no isakmp security associations at all and when I enter the debugging to this output.

  CRYPTO: IPSEC (crypto_map_check_encrypt_core): CRYPTO: removed package as currently being created cryptomap.

  Any ideas why I get this result? Any help will be a great help

  Thank you!!!

  I think it's possible. It seems to me that you are assuming that the address of the interface where goes the card encryption is peering address. While this is the default action, it is possible to configure it differently.

  As you have discovered the card encryption must be on the physical output interface. If you want the peering address to have a different value of the physical interface address outgoing, then you can add this command to your crypto card:

  card crypto-address

  so if you put loopback0 as the id_interface then he would use loopback0 as peering address even if the card encryption may be affected on serial0/0 or another physical interface.

  HTH

  Rick

• Using Loopback Interface as Source GRE/IPSec tunnel

  Hi all:

  I need one to spend a working router to router VPN tunnel using an IP WAN IP interface loopback as a source.  I am able to ping the loopback from the other router.  As soon as I change the source of tunnel to use the loopback IP address, change the encryption ACL map, and move the cryptographic card of the WAN interface to the loopback interface, the tunnel will not come to the top.  If I remove all the crypto config, the tunnel comes up fine as just a GRE tunnel.  On the other router, I see the message that says that's not encrypting the traffic below.

  * 00:10:33.515 Mar 1: % CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd package not an IPSEC packet. (ip) vrf/adr_dest = 192.168.0.1, src_addr = 192.168.1.2, prot = 47

  What Miss me?  Is there something else that needs to be done to use the closure of a GRE/IPSec tunnel?

  I have install below config in the laboratory to see if I can get it even work in a non-production environment.

  R1 WAN IP: 192.168.0.1

  R2 WAN IP: 192.168.0.2

  R2 Closure: 192.168.1.2

  hostname R2

  !

  crypto ISAKMP policy 1

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  ISAKMP crypto key abc123 address 192.168.0.1

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac T1

  transport mode

  !

  crypto map 1 VPN ipsec-isakmp

  Description remote control

  defined peer 192.168.0.1

  game of transformation-T1

  match address VPN1

  !

  interface Loopback0

  IP 192.168.1.2 255.255.255.255

  VPN crypto card

  !

  Tunnel1 interface

  IP 172.30.240.2 255.255.255.252

  IP mtu 1440

  KeepAlive 10 3

  tunnel source 192.168.1.2

  tunnel destination 192.168.0.1

  VPN crypto card

  !

  interface FastEthernet0

  IP 192.168.0.2 255.255.255.0

  !

  VPN1 extended IP access list

  allow ACCORD 192.168.1.2 host 192.168.0.1

  you have tried to add "card crypto VPN 1 - address Loopback0".

• GRE and IPSEC VPN tunnel over the same interface

  My client is currently connected to a service provider of call through a GRE Tunnel over IPSEC. They chose to move all connections to a VPN site-to-site traditional behind a firewall, here, to your corp office.  As the questions says, is possible for me to put in place the VPN site to site on the same router? Interface Tunnelx both ethernet have the same encryption card assigned to the destination router.  I thought that traffic could divide by identification of traffic 'interesting '.  Thanks for all the ideas, suggestions

  Ray

  Ray

  Thanks for the additional information. It takes so that the existing entries in ACL 101 remain so the existing tunnel will still work. And you have to add entries that will allow the new tunnel. Editing an ACL that is actively filtering traffic can get complicated. Here is a technique that I use sometimes.

  -create a new access list (perhaps ACL 102 assuming that 102 is not already in use).

  -Copy the entries of ACL 101 to 102 and add additional entries you need in places appropriate in the ACL.

  -Once the new version of the ACL is complete in the config, then go tho the interface and change the ip access-group to point to the new ACL.

  This provides a transition that does not affect traffic. And he made it back to the original easy - especially if something does not work as expected in the new ACL.

  If the encryption of the remote card has an entry for GRE and a separate entrance for the IPSec which is a good thing and should work. I guess card crypto for GRE entry specifies an access list that allows the GRE traffic and for IPSec crypto map entry points to a different access list that identifies the IP traffic is encrypted through the IPSec tunnel.

  HTH

  Rick

• GRE over IPSEC

  Hi all

  I am setting up IPSEC tunnel GRE... I am able to get neighbors OSPF looked through the GRE tunnel, but when traffic is sent through the gre tunnel it does not encrypt and transmit through plaintext despite she buy from loopback interfaces

  Here is my config

  Config of R1
  crypto ISAKMP policy 10
  BA aes
  preshared authentication
  Group 5
  test key crypto isakmp 192.168.1.2 address

  Crypto ipsec transform-set test aes - esp esp-sha-hmac

  test card crypto-address Ethernet0/0
  test 10 map ipsec-isakmp crypto
  defined peer 192.168.1.2
  Set transform-set test
  match address WILL

  GRE extended IP access list
  allow gre 10.0.10.0 0.0.0.255 10.0.20.0 0.0.0.255

  interface Ethernet0/0
  No switchport
  IP 192.168.1.1 255.255.255.0
  crypto map test

  interface Loopback0
  IP 10.0.10.1 255.255.255.0
  IP ospf 1 zone 0

  Tunnel1 interface
  10.0.100.2 IP address 255.255.255.0
  IP ospf 1 zone 0
  source of tunnel Ethernet0/0
  tunnel destination 192.168.1.1
  end

  -----------------------------------------------------------
  R2 config

  crypto ISAKMP policy 10
  BA aes
  preshared authentication
  Group 5
  test key crypto isakmp 192.168.1.1 address
  !
  !
  Crypto ipsec transform-set test aes - esp esp-sha-hmac
  !
  !
  !
  test card crypto-address Ethernet0/0
  test 10 map ipsec-isakmp crypto
  defined peer 192.168.1.1
  Set transform-set test
  match address GR
  !

  GR extended IP access list
  allow gre 10.0.20.0 0.0.0.255 10.0.10.0 0.0.0.255

  interface Ethernet0/0
  No switchport
  IP 192.168.1.2 255.255.255.0
  crypto map test

  interface Loopback0
  IP 10.0.20.1 255.255.255.0
  IP ospf 1 zone 0

  Tunnel1 interface
  10.0.100.1 IP address 255.255.255.0
  IP ospf 1 zone 0
  source of tunnel Ethernet0/0
  tunnel destination 192.168.1.2
  end

  -------------------------------------------

  Hello

  With p2p GRE over IPsec solution, all traffic between sites is encapsulated in a GRE p2p package before the process of encryption.

  More info on this link:

  http://www.Cisco.com/c/en/us/TD/docs/solutions/Enterprise/WAN_and_MAN/P2...

  Kind regards

  Aditya

  Please evaluate the useful messages and mark the correct answers.

• I can weight of the IPSec Tunnels between ASAs

  Hello

  Remote site: link internet NYC 150 MB/s

  Local site: link internet Baltimore 400 MB/s

  Backup site: link internet Washington 200 Mb/s

  My main site and my backup site are connected via a gigabit Ethernet circuit between the respective base site switches.  Each site has its own internet connection and my OSPF allows to switch their traffic to the backup site if the main website is down.  We are opening an office in New York with one ASA unique connected to 150 Mbps FIOS internet circuit.  We want to set up an IPSec tunnel on the main site and the backup on the remote site, but want the remote site to prefer the tunnel in Baltimore, except if it is down.

  Interesting traffic would be the same for the two tunnels

  I know that ASA cannot be a GRE endpoint.  How can I force the New York traffic through the tunnel in Baltimore as long as it works?  An IPSec tunnel can be weighted?

  Thank you

  It is not in itself weighting, but you can create up to 10 backup over LAN to LAN VPN IPsec peers.

  For each tunnel, the security apparatus tried to negotiate with the first peer in the list. If this peer does not respond, the security apparatus made his way to the bottom of the list until a peer responds, or there is no peer more in the list.

  Reference.

• PIX IPSec tunnel - IOS, routing Options

  Hello

  I have an IPSec Tunnel between a PIX firewall and a router Cisco 1721.

  Have I not all options about any routing protocol can I use?

  Are there plans to add GRE support to PIX, so that EIGRP, OSPF can be used?

  ------Naman

  Here's a URL that tells how to configure GRE over IPSEC with OSPF. http://www.Cisco.com/warp/public/707/gre_ipsec_ospf.html

• WILL secure IPSec tunnel

  Hi all

  I have just set up an IPSec tunnel, except use debug crypto ipsec / isakmp how can I check IPSec works? When I configure the encryption card, can I use ip of the tunnel as the peer address.

  Thanks in advance.

  Banlan

  Hi Banlan,

  Thanks for your appreciation. I feel honoured!

  Back to your question about free WILL inside the IPSec, you must use the gre as the Protocol in the access list; This right, shud you get points for that! (because the ip packet is encapsulated by GRE and then AH / ESP headers are added). Also remember that the ip address as the destination of the tunnel should be globally routable. You cannot use tunneling as a destination of the tunnel (except of course when the routers are connected back to back)

  See the following configs for GRE inside IPSec.

  ! ON THE INITIATOR

  ...

  ...

  access-list 110 permit host WILL

  ...

  12 crypto isakmp policy

  preshared authentication

  !

  address ISAKMP crypto key xxxxx

  Crypto ipsec transform-set esp TS - a

  !

  card 11 CM ipsec-isakmp crypto

  defined by peers

  game of transformation-TS

  match address 110

  !

  tunnel1 interface

  IP unnumbered

  source of tunnel

  tunnel destination

  card crypto CM

  !

  interface

  card crypto CM

  !

  IP route x.x.x.x tunnel1

  ! ON THE ANSWERING MACHINE

  ...

  ...

  access-list 111 allow host WILL

  ...

  crypto ISAKMP policy 11

  preshared authentication

  !

  address ISAKMP crypto key xxxxx

  Crypto ipsec transform-set esp TS - a

  !

  Map 10 CM ipsec-isakmp crypto

  defined by peers

  game of transformation-TS

  match address 111

  !

  interface tunnels2

  IP unnumbered

  source of tunnel

  tunnel destination

  card crypto CM

  !

  interface

  card crypto CM

  !

  IP route x.x.x.x tunnels2

  I think you have the answer now. Catch me if you want something else.

  Cheers :-))

  Naveen

  [email protected] / * /.

• DMVPN & GRE over IPsec on the same physical interface

  Dear all,

  I am setting up two routers WAN, each router wan has a physical interface connecting to the branches and regional office by using the same provider.

  We will use the GRE over IPsec to connect to Office regional and DMVPN + EIGRP to branches.

  I would like to know if it is possible to configure tunnels for GRE over IPsec and DMVPN + EIGRP using the same source physical interface.

  Good answer, it's an urgent request and your response is much appreciated.

  Kind regards

  Hi Savio,

  It should work. We can configure dmvpn and gre-over-ipsec on ASA using the same physical interface.

  Kind regards

  NGO

• Tunnel traffic inside IPSEC tunnel

  Hello world

  Site has a Site B through ASA IP Sec Tunnel.

  Now turn on Site a GRE tunnel and the tunnel destination is happening inside the IPSEC tunnel.

  In other words, IPSEC tunnel between 2 sites also leads the GRE Tunnel traffic.

  Who's in charge, I can run on ASA whether IPSEC is transport traffic of the GRE tunnel or

  Which line in config ASA will tell me that this IPSEC also conducts traffic GRE tunnel?

  Thank you

  MAhesh

  Hello

  I think that you will probably see GRE in the ASA connection table when the connection is in use.

  You can try the command

  Show conn | Volition Inc.

  And see if this produceses matter what exit.

  Can you possibly provide "interface Tunnelx" configurations and if its using other interfaces such as 'tunnel source' and 'destination tunnel' then their configurations also.

  -Jouni