How to Configure GRE VPN - Revision history

Mtsega: /* Test and Verify VPN Connectivity */

2010-12-13T15:21:50Z

Test and Verify VPN Connectivity

← Older revision		Revision as of 15:21, 13 December 2010
Line 281:		Line 281:
	*Use show crypto engine connections active, show crypto map and show crypto ipsec sa command s to verify connection.		*Use show crypto engine connections active, show crypto map and show crypto ipsec sa command s to verify connection.
	R2#show crypto engine connections active		R2#show crypto engine connections active

	Crypto Engine Connections		Crypto Engine Connections
	ID Type Algorithm Encrypt Decrypt IP-Address		ID Type Algorithm Encrypt Decrypt IP-Address
Line 289:		Line 290:

	R2# show crypto map		R2# show crypto map

	Crypto Map "vpn" 12 ipsec-isakmp		Crypto Map "vpn" 12 ipsec-isakmp
	Description: VPN from R2 to R1		Description: VPN from R2 to R1
Line 306:		Line 308:

	R2#show crypto ipsec sa		R2#show crypto ipsec sa


	interface: Serial0/0/1		interface: Serial0/0/1

Mtsega at 15:17, 13 December 2010

2010-12-13T15:17:29Z

← Older revision		Revision as of 15:17, 13 December 2010
Line 77:		Line 77:
	== '''Enable EIGRP with process ID 1 on R1 and R2''' ==		== '''Enable EIGRP with process ID 1 on R1 and R2''' ==

	Advertise the LAN interface Fa0/0 and the tunnel interfaces on both R1 and R2. Do not advertise to ISP router.		*Advertise the LAN interface Fa0/0 and the tunnel interfaces on both R1 and R2. Do not advertise to ISP router.

	R1(config)#router eigrp 1		R1(config)#router eigrp 1
Line 93:		Line 93:
	R2(config-router)#end		R2(config-router)#end

	Apply default route on R1 and R2		*Apply default route on R1 and R2

	R1(config)#ip route 0.0.0.0 0.0.0.0 s0/0/0		R1(config)#ip route 0.0.0.0 0.0.0.0 s0/0/0
Line 99:		Line 99:
	Before you configure authentication and encryption test that the network is working as planned. So that you will know what to troubleshoot incase you encounter a problem at the end and It is easier to troubleshootin before you apply authentication and encryption.		Before you configure authentication and encryption test that the network is working as planned. So that you will know what to troubleshoot incase you encounter a problem at the end and It is easier to troubleshootin before you apply authentication and encryption.

	Check the interfaces on R1, R2, and ISP routers using show ip interface brief command.		*Check the interfaces on R1, R2, and ISP routers using show ip interface brief command.

	R2#show ip int brief		R2#show ip int brief
Line 112:		Line 112:


	Use show ip route command to check the routing table on R1 and R2.		*Use show ip route command to check the routing table on R1 and R2.

	R1#show ip route		R1#show ip route
Line 133:		Line 133:
	S* 0.0.0.0/0 [1/0] via 10.2.2.1		S* 0.0.0.0/0 [1/0] via 10.2.2.1

	Test connectivity using ping command between PC1 and PC2 or use extended ping from R1 LAN interface Fa0/0 to R2 LAN interface and vice-versa.		*Test connectivity using ping command between PC1 and PC2 or use extended ping from R1 LAN interface Fa0/0 to R2 LAN interface and vice-versa.

	R2#ping ip		R2#ping ip
Line 159:		Line 159:
	== '''IPsec Encryption and Authentication''' ==		== '''IPsec Encryption and Authentication''' ==

	Configure an Internet Security Association and Key Management Protocol (ISAKMP) policy, an ISAKMP key, and an IPSec transform set. The ISAKMP policy, key, and IPSec transform set must match on both sides of a single tunnel.		*Configure an Internet Security Association and Key Management Protocol (ISAKMP) policy, an ISAKMP key, and an IPSec transform set. The ISAKMP policy, key, and IPSec transform set must match on both sides of a single tunnel.

	R1(config)#crypto isakmp policy 1		R1(config)#crypto isakmp policy 1
Line 172:		Line 172:
	R1(config)#crypto ipsec transform-set aes-sha esp-aes esp-sha-hmac		R1(config)#crypto ipsec transform-set aes-sha esp-aes esp-sha-hmac

	Extended access control list that permit ip only from R2 serial 0/0/1 to R1 serial 0/0/0 interface.		*Extended access control list that permit ip only from R2 serial 0/0/1 to R1 serial 0/0/0 interface.
	R1(config)#access-list 101 permit GRE host 10.2.2.2 host 10.1.1.2		R1(config)#access-list 101 permit GRE host 10.2.2.2 host 10.1.1.2

	Configure the crypto map on R1		*Configure the crypto map on R1

	R1(config)#crypto map vpn 11 ipsec-isakmp		R1(config)#crypto map vpn 11 ipsec-isakmp
Line 207:		Line 207:
	R2(cfg-crypto-trans)#exit		R2(cfg-crypto-trans)#exit

	Extended access control list that permit ip only from R1 serial 0/0/0 to R2 serial 0/0/1 interface.		*Extended access control list that permit ip only from R1 serial 0/0/0 to R2 serial 0/0/1 interface.
	R2(config)#access-list 102 permit GRE host 10.1.1.2 host 10.2.2.2		R2(config)#access-list 102 permit GRE host 10.1.1.2 host 10.2.2.2


	Configure the crypto map on R2		*Configure the crypto map on R2

	R2(config)#crypto map vpn 12 ipsec-isakmp		R2(config)#crypto map vpn 12 ipsec-isakmp
Line 235:		Line 235:


	Use show ip route command on R1 to check that a route exist to 192.168.20.0/24 network through the tunnel interface. Do the same on R2 to verify that a route exist to 192.168.10.0/24 network through the tunnel interface.		*Use show ip route command on R1 to check that a route exist to 192.168.20.0/24 network through the tunnel interface. Do the same on R2 to verify that a route exist to 192.168.10.0/24 network through the tunnel interface.

	R2#show ip route		R2#show ip route
Line 256:		Line 256:
	S* 0.0.0.0/0 [1/0] via 10.1.1.1		S* 0.0.0.0/0 [1/0] via 10.1.1.1

	Use ping or extended ping command to test connectivity between 192.168.10.0/24 and 192.168.20.0/24 network.		*Use ping or extended ping command to test connectivity between 192.168.10.0/24 and 192.168.20.0/24 network.

	R1#ping ip		R1#ping ip
Line 279:		Line 279:


	Use show crypto engine connections active, show crypto map and show crypto ipsec sa command s to verify connection.		*Use show crypto engine connections active, show crypto map and show crypto ipsec sa command s to verify connection.
	R2#show crypto engine connections active		R2#show crypto engine connections active
	Crypto Engine Connections		Crypto Engine Connections
Line 336:		Line 336:
	replay detection support: Y		replay detection support: Y
	Status: ACTIVE		Status: ACTIVE
			inbound ah sas:
	inbound ah sas:		inbound pcp sas:

	inbound pcp sas:

	outbound esp sas:		outbound esp sas:
Line 350:		Line 348:
	replay detection support: Y		replay detection support: Y
	Status: ACTIVE		Status: ACTIVE
			outbound ah sas:
	outbound ah sas:		outbound pcp sas:

	outbound pcp sas:

Mtsega: /* Configure Router and GRE Tunnel Interfaces */

2010-12-13T15:07:18Z

Configure Router and GRE Tunnel Interfaces

← Older revision		Revision as of 15:07, 13 December 2010
Line 14:		Line 14:
	== '''Configure Router and GRE Tunnel Interfaces ''' ==		== '''Configure Router and GRE Tunnel Interfaces ''' ==

	Configure R1, R2 and ISP routers with IP addresses and masks.		*'''Configure R1, R2 and ISP routers with IP addresses and masks.'''

	R1#configure terminal		R1#configure terminal
Line 51:		Line 51:
	ISP#		ISP#

	'''Configure PC1 and PC2 with IP address and default gateway'''.		*'''Configure PC1 and PC2 with IP address and default gateway'''.


	'''Configure GRE Tunnel interface on R1 and R2'''		*'''Configure GRE Tunnel interface on R1 and R2'''

	R1(config)#interface tunnel 0		R1(config)#interface tunnel 0
Line 74:		Line 74:
	R2(config-if)#end		R2(config-if)#end
	Tunnel source is R2’s serial 0/0/1 interface and tunnel destination is R1’s serial 0/0/0 interface.		Tunnel source is R2’s serial 0/0/1 interface and tunnel destination is R1’s serial 0/0/0 interface.


	== '''Enable EIGRP with process ID 1 on R1 and R2''' ==		== '''Enable EIGRP with process ID 1 on R1 and R2''' ==

Mtsega: /* Prepare the Network and Basic Configurations */

2010-12-13T15:05:15Z

Prepare the Network and Basic Configurations

← Older revision		Revision as of 15:05, 13 December 2010
Line 6:		Line 6:
	==''' Prepare the Network and Basic Configurations''' ==		==''' Prepare the Network and Basic Configurations''' ==

	*[Cable the network according the topology diagram.]		*Cable the network according the topology diagram.

	*[Clear existing configurations on the routers.]		*Clear existing configurations on the routers.

	*[Perform basic router configuration.]		*Perform basic router configuration.

	== '''Configure Router and GRE Tunnel Interfaces ''' ==		== '''Configure Router and GRE Tunnel Interfaces ''' ==

Mtsega: /* Prepare the Network and Basic Configurations */

2010-12-13T15:04:08Z

Prepare the Network and Basic Configurations

← Older revision		Revision as of 15:04, 13 December 2010
Line 6:		Line 6:
	==''' Prepare the Network and Basic Configurations''' ==		==''' Prepare the Network and Basic Configurations''' ==

	*[[Cable the network according the topology diagram.]]		*[Cable the network according the topology diagram.]

	*[[Clear existing configurations on the routers.]]		*[Clear existing configurations on the routers.]

	*[[Perform basic router configuration.]]		*[Perform basic router configuration.]

	== '''Configure Router and GRE Tunnel Interfaces ''' ==		== '''Configure Router and GRE Tunnel Interfaces ''' ==

Mtsega: /* Prepare the Network and Basic Configurations */

2010-12-13T15:03:00Z

Prepare the Network and Basic Configurations

← Older revision		Revision as of 15:03, 13 December 2010
Line 6:		Line 6:
	==''' Prepare the Network and Basic Configurations''' ==		==''' Prepare the Network and Basic Configurations''' ==

	Cable the network according the topology diagram.		*[[Cable the network according the topology diagram.]]

	Clear existing configurations on the routers.		*[[Clear existing configurations on the routers.]]

	~~Perform basic router configuration.~~

			*[[Perform basic router configuration.]]

	== '''Configure Router and GRE Tunnel Interfaces ''' ==		== '''Configure Router and GRE Tunnel Interfaces ''' ==

Mtsega at 08:57, 13 December 2010

2010-12-13T08:57:09Z

← Older revision		Revision as of 08:57, 13 December 2010
Line 7:		Line 7:

	Cable the network according the topology diagram.		Cable the network according the topology diagram.

	Clear existing configurations on the routers.		Clear existing configurations on the routers.

	Perform basic router configuration.		Perform basic router configuration.

Mtsega: moved User:Mtsega to How to Configure GRE VPN

2010-12-13T08:55:21Z

moved User:Mtsega to How to Configure GRE VPN

← Older revision	Revision as of 08:55, 13 December 2010
(No difference)

Mtsega at 08:53, 13 December 2010

2010-12-13T08:53:42Z

Mtsega at 08:49, 13 December 2010

2010-12-13T08:49:13Z

Show changes

← Older revision		Revision as of 08:53, 13 December 2010
Line 103:		Line 103:
	R2#show ip int brief		R2#show ip int brief

	Interface IP-Address OK? Method Status Protocol		Interface IP-Address OK? Method Status Protocol
	FastEthernet0/0 192.168.20.1 YES manual up up		FastEthernet0/0 192.168.20.1 YES manual up up
	FastEthernet0/1 unassigned YES unset administratively down down		FastEthernet0/1 unassigned YES unset administratively down down
	Serial0/0/0 unassigned YES unset administratively down down		Serial0/0/0 unassigned YES unset administratively down down
	Serial0/0/1 10.1.1.2 YES manual up up		Serial0/0/1 10.1.1.2 YES manual up up
	Tunnel0 192.168.1.2 YES manual up up		Tunnel0 192.168.1.2 YES manual up up


Line 115:		Line 115:

	R1#show ip route		R1#show ip route
	Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP		Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
	D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area		D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
	N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2		N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
Line 123:		Line 123:
	o - ODR, P - periodic downloaded static route		o - ODR, P - periodic downloaded static route

	Gateway of last resort is 10.2.2.1 to network 0.0.0.0		Gateway of last resort is 10.2.2.1 to network 0.0.0.0

	C 192.168.10.0/24 is directly connected, FastEthernet0/0		C 192.168.10.0/24 is directly connected, FastEthernet0/0
	D 192.168.20.0/24 [90/26882560] via 192.168.1.2, 00:01:33, Tunnel0		D 192.168.20.0/24 [90/26882560] via 192.168.1.2, 00:01:33, Tunnel0
	10.0.0.0/30 is subnetted, 1 subnets		10.0.0.0/30 is subnetted, 1 subnets
	C 10.2.2.0 is directly connected, Serial0/0/0		C 10.2.2.0 is directly connected, Serial0/0/0
	192.168.1.0/30 is subnetted, 1 subnets		192.168.1.0/30 is subnetted, 1 subnets
	C 192.168.1.0 is directly connected, Tunnel0		C 192.168.1.0 is directly connected, Tunnel0
	S* 0.0.0.0/0 [1/0] via 10.2.2.1		S* 0.0.0.0/0 [1/0] via 10.2.2.1

	Test connectivity using ping command between PC1 and PC2 or use extended ping from R1 LAN interface Fa0/0 to R2 LAN interface and vice-versa.		Test connectivity using ping command between PC1 and PC2 or use extended ping from R1 LAN interface Fa0/0 to R2 LAN interface and vice-versa.
Line 238:		Line 238:

	R2#show ip route		R2#show ip route
	Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP		Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
	D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area		D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
	N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2		N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
Line 246:		Line 246:
	o - ODR, P - periodic downloaded static route		o - ODR, P - periodic downloaded static route

	Gateway of last resort is 10.1.1.1 to network 0.0.0.0		Gateway of last resort is 10.1.1.1 to network 0.0.0.0

	D 192.168.10.0/24 [90/26882560] via 192.168.1.1, 00:13:17, Tunnel0		D 192.168.10.0/24 [90/26882560] via 192.168.1.1, 00:13:17, Tunnel0
	C 192.168.20.0/24 is directly connected, FastEthernet0/0		C 192.168.20.0/24 is directly connected, FastEthernet0/0
	10.0.0.0/30 is subnetted, 1 subnets		10.0.0.0/30 is subnetted, 1 subnets
	C 10.1.1.0 is directly connected, Serial0/0/1		C 10.1.1.0 is directly connected, Serial0/0/1
	192.168.1.0/30 is subnetted, 1 subnets		192.168.1.0/30 is subnetted, 1 subnets
	C 192.168.1.0 is directly connected, Tunnel0		C 192.168.1.0 is directly connected, Tunnel0
	S* 0.0.0.0/0 [1/0] via 10.1.1.1		S* 0.0.0.0/0 [1/0] via 10.1.1.1

	Use ping or extended ping command to test connectivity between 192.168.10.0/24 and 192.168.20.0/24 network.		Use ping or extended ping command to test connectivity between 192.168.10.0/24 and 192.168.20.0/24 network.

	R1#ping ip		R1#ping ip
	Target IP address: 192.168.20.1		Target IP address: 192.168.20.1
	Repeat count [5]:		Repeat count [5]:
	Datagram size [100]:		Datagram size [100]:
	Timeout in seconds [2]:		Timeout in seconds [2]:
	Extended commands [n]: y		Extended commands [n]: y
	Source address or interface: 192.168.10.1		Source address or interface: 192.168.10.1
	Type of service [0]:		Type of service [0]:
	Set DF bit in IP header? [no]:		Set DF bit in IP header? [no]:
	Validate reply data? [no]:		Validate reply data? [no]:
	Data pattern [0xABCD]:		Data pattern [0xABCD]:
	Loose, Strict, Record, Timestamp, Verbose[none]:		Loose, Strict, Record, Timestamp, Verbose[none]:
	Sweep range of sizes [n]:		Sweep range of sizes [n]:
	Type escape sequence to abort.		Type escape sequence to abort.
	Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:		Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
	Packet sent with a source address of 192.168.10.1		Packet sent with a source address of 192.168.10.1
	!!!!!		!!!!!
	Success rate is 100 percent (5/5), round-trip min/avg/max = 36/36/36 ms		Success rate is 100 percent (5/5), round-trip min/avg/max = 36/36/36 ms