Cisco Labs and Examples – GRE and IPsec Tunnels

• Version
• Download 2
• File Size 100.37 KB
• File Count 1
• Create Date January 10, 2025
• Last Updated January 10, 2025

Cisco GRE and IPsec Lab Guide

Generic Routing Encapsulation (GRE) and Internet Protocol Security (IPsec) are two important technologies used in network engineering to create secure and efficient communication channels. This lab guide will help you understand how to configure and implement GRE over IPsec on Cisco devices.

1. Introduction to GRE and IPsec

• GRE: GRE is a tunneling protocol developed by Cisco that encapsulates a wide variety of network layer protocols inside virtual point-to-point links over an IP network. It is used to create a direct, logical link between two network nodes.
• IPsec: IPsec is a suite of protocols designed to secure IP communications by authenticating and encrypting each IP packet in a communication session. It provides data confidentiality, integrity, and authentication.

2. Why Use GRE over IPsec?

Using GRE over IPsec combines the benefits of both protocols:

• GRE allows the encapsulation of multiple protocols and supports multicast traffic, which is not possible with IPsec alone.
• IPsec provides the necessary security features to protect the data being transmitted through the GRE tunnel.

3. Lab Setup

For this lab, you will need:

• Two Cisco routers (R1 and R2) with IP connectivity between them.
• Basic knowledge of Cisco IOS commands and configurations.

4. Configuring GRE Tunnel

1. Configure GRE Tunnel on R1:

   R1(config)# interface Tunnel0
   R1(config-if)# ip address 10.0.0.1 255.255.255.252
   R1(config-if)# tunnel source 192.168.1.1
   R1(config-if)# tunnel destination 192.168.2.1
   R1(config-if)# tunnel mode gre ip

2. Configure GRE Tunnel on R2:

   R2(config)# interface Tunnel0
   R2(config-if)# ip address 10.0.0.2 255.255.255.252
   R2(config-if)# tunnel source 192.168.2.1
   R2(config-if)# tunnel destination 192.168.1.1
   R2(config-if)# tunnel mode gre ip

5. Configuring IPsec

1. Create ISAKMP Policy on R1:

   R1(config)# crypto isakmp policy 10
   R1(config-isakmp)# encryption aes
   R1(config-isakmp)# hash sha
   R1(config-isakmp)# authentication pre-share
   R1(config-isakmp)# group 2
   R1(config-isakmp)# lifetime 86400

2. Create ISAKMP Policy on R2:

   R2(config)# crypto isakmp policy 10
   R2(config-isakmp)# encryption aes
   R2(config-isakmp)# hash sha
   R2(config-isakmp)# authentication pre-share
   R2(config-isakmp)# group 2
   R2(config-isakmp)# lifetime 86400

3. Configure Pre-shared Key on R1 and R2:

   R1(config)# crypto isakmp key cisco123 address 192.168.2.1
   R2(config)# crypto isakmp key cisco123 address 192.168.1.1

4. Create IPsec Transform Set on R1:

   R1(config)# crypto ipsec transform-set MY_TRANSFORM_SET esp-aes esp-sha-hmac

5. Create IPsec Transform Set on R2:

   R2(config)# crypto ipsec transform-set MY_TRANSFORM_SET esp-aes esp-sha-hmac

6. Create Crypto Map on R1:

   R1(config)# crypto map MY_CRYPTO_MAP 10 ipsec-isakmp
   R1(config-crypto-map)# set peer 192.168.2.1
   R1(config-crypto-map)# set transform-set MY_TRANSFORM_SET
   R1(config-crypto-map)# match address 100

7. Create Crypto Map on R2:

   R2(config)# crypto map MY_CRYPTO_MAP 10 ipsec-isakmp
   R2(config-crypto-map)# set peer 192.168.1.1
   R2(config-crypto-map)# set transform-set MY_TRANSFORM_SET
   R2(config-crypto-map)# match address 100

8. Apply Crypto Map to Interfaces on R1 and R2:

   R1(config)# interface FastEthernet0/0
   R1(config-if)# crypto map MY_CRYPTO_MAP
   R2(config)# interface FastEthernet0/0
   R2(config-if)# crypto map MY_CRYPTO_MAP

6. Verification

1. Verify GRE Tunnel:

   R1# show ip interface brief
   R2# show ip interface brief

2. Verify IPsec:

   R1# show crypto isakmp sa
   R1# show crypto ipsec sa
   R2# show crypto isakmp sa
   R2# show crypto ipsec sa

By following this lab guide, you will be able to configure and verify a GRE tunnel secured with IPsec on Cisco routers. This setup ensures that your data is securely transmitted over the network while maintaining the flexibility of GRE.