Typical Configuration Of GRE-Over-IPSec Configuration on AR Series Routers

Typical Configuration Of GRE-Over-IPSec Configuration on AR Series Routers

 

[Requirements]

Branches 1 and 2 are connected to the center by means of aggressive IPSec, and run OSPF on the tunnel by using GRE -Over-IPSec to interwork with the headquarters.

[Networking diagram]

 

[Configuration script]

Configuration script (center)

# sysname Center # ike local-name center              /Local-name of the center IKE is center/ # router id 1.1.1.1 # radius scheme system # domain system # ike peer branch1                 /Configure the IKE peer to branch 1/ exchange-mode aggressive         /Set IPSec to the aggressive mode/ pre-shared-key abc               /Set the pre-shared key to abc/ id-type name                     /Configure name as the ID used in IKE negotiation/ remote-name branch1              /Set the name of branch 1 as branch1/ # ike peer branch2                  /Configure the IKE peer to branch 2/ exchange-mode aggressive pre-shared-key abc id-type name remote-name branch2 # ipsec proposal 1                  /Define IPSec proposal/ # ipsec policy center 10 isakmp     /Configure the IPsec policy to branch 1/ security acl 3001                /Specify the number of ACL applied in IPSec policy/ ike-peer branch1                /Apply the IKE peer/ proposal 1                      /Apply the IPSec proposal/ # ipsec policy center 20 isakmp    /The configuration for branch 2 is similar to that for branch 1/ security acl 3002 ike-peer branch2 proposal 1 # acl number 3001                  /Define the GRE data stream from center to branch 1/ rule 0 permit gre source 202.101.1.2 0 destination 202.101.2.2 0 acl number 3002                  /Define the GRE data stream from center to branch 2/ rule 0 permit gre source 202.101.1.2 0 destination 202.101.3.2 0 # interface Serial2/0 link-protocol ppp ip address 202.101.1.2 255.255.255.252 ipsec policy center              /Apply the IPSec policy on the egress of the Internet/ # interface Tunnel0                 /Configure the GRE tunnel between center and branch 1/ ip address 10.0.0.1 255.255.255.252 source 202.101.1.2 destination 202.101.2.2 # interface Tunnel1                 /Configure the GRE tunnel between center and branch 2/ ip address 10.0.0.5 255.255.255.252 source 202.101.1.2 destination 202.101.3.2 # interface NULL0 # interface LoopBack0 ip address 1.1.1.1 255.255.255.255 # interface Ethernet0/0 ip address 192.168.1.1 255.255.255.0  /Intranet address of the center/ # ospf 1 area 0.0.0.10                        /Branch 1 belongs to area 10/ network 10.0.0.0 0.0.0.3 # area 0.0.0.20                        /Branch 2 belongs to area 20/ network 10.0.0.4 0.0.0.3 # area 0.0.0.0                         /The headquarters belongs to area 0/ network 1.1.1.1 0.0.0.0 network 192.168.1.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.101.1.1 preference 60 # user-interface con 0 user-interface vty 0 4 # return

Configuration script (branch 1)

# sysname Branch1 # ike local-name branch1             /Local-name of the branch 1 IKE is branch1/ # radius scheme system # domain system # ike peer center                     /Configure the IKE peer to the center/ exchange-mode aggressive           /Set IPSec to the aggressive mode/ pre-shared-key abc                 /Set the pre-shared key to abc/ id-type name                       /Configure name as the ID used in IKE negotiation/ remote-name center                 /The peer name is center/ remote-address 202.101.1.2         /The peer address is 202.101.1.2 (Internet address of the center)/ # ipsec proposal 1                    /Define IPSec proposal/ # ipsec policy branch1 10 isakmp      /Configure the IPsec policy to the center/ security acl 3001                  /Specify the number of ACL applied in IPSec policy/ ike-peer center                    /Apply the IKE peer/ proposal 1                         /Apply the IPSec proposal/ # acl number 3001                     /Define the GRE data stream from branch 1 to center/ rule 0 permit gre source 202.101.2.2 0 destination 202.101.1.2 0 # interface Serial2/0 link-protocol ppp ip address 202.101.2.2 255.255.255.252 ipsec policy branch1               /Apply the IPSec policy on the egress of the Internet/ # interface Tunnel0                   /Configure the GRE tunnel between branch 1 and center/ ip address 10.0.0.2 255.255.255.252 source 202.101.2.2 destination 202.101.1.2 # interface NULL0 # interface LoopBack0 ip address 2.2.2.2 255.255.255.255 # interface Ethernet0/0               /Configure the intranet address for branch 1/ ip address 192.168.2.1 255.255.255.0 # ospf 1 area 0.0.0.10                      /Branch 1 belongs to area 10/ network 2.2.2.2 0.0.0.0 network 10.0.0.0 0.0.0.3 network 192.168.2.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.101.2.1 preference 60 # user-interface con 0 user-interface vty 0 4 # return

Configuration script (branch 2)

# sysname Branch2 # ike local-name branch1         /Local-name of the branch 2 IKE is branch2/ # radius scheme system # domain system # ike peer center                /Configure the IKE peer to the center/ exchange-mode aggressive      /Set IPSec to the aggressive mode/ pre-shared-key abc            /Set the pre-shared key to abc/ id-type name                  /Configure name as the ID used in IKE negotiation/ remote-name center            /The peer name is center/ remote-address 202.101.1.2    /The peer address is 202.101.1.2 (Internet address of the center)/ # ipsec proposal 1               /Define IPSec proposal/ # ipsec policy branch1 10 isakmp /Configure the IPsec policy to the center/ security acl 3001             /Specify the number of ACL applied in IPSec policy/ ike-peer center               /Apply the IKE peer/ proposal 1                    /Apply the IPSec proposal/ # acl number 3001                /Define the GRE data stream from branch 2 to center/ rule 0 permit gre source 202.101.3.2 0 destination 202.101.1.2 0 # interface Serial2/0 link-protocol ppp ip address 202.101.3.2 255.255.255.252 ipsec policy branch2          /Apply the IPSec policy on the egress of the Internet/ # interface Tunnel0              /Configure the GRE tunnel between branch 2 and center/ ip address 10.0.0.6 255.255.255.252 source 202.101.3.2 destination 202.101.1.2 # interface NULL0 # interface LoopBack0 ip address 3.3.3.3 255.255.255.255 # interface Ethernet0/0           /Configure the intranet address for branch 2/ ip address 192.168.3.1 255.255.255.0 # ospf 1 area 0.0.0.20                  /Branch 2 belongs to area 20/ network 3.3.3.3 0.0.0.0 network 10.0.0.4 0.0.0.3 network 192.168.3.0 0.0.0.255 # ip route-static 0.0.0.0 0.0.0.0 202.101.3.1 preference 60 # user-interface con 0 user-interface vty 0 4 # return

 

---

[Verification]

1. IKE SA status on the center:

disp ike sa

    connection-id  peer            flag        phase   doi

  ----------------------------------------------------------

        4          202.101.3.2     RD            1     IPSEC

        5          202.101.3.2     RD            2     IPSEC

        2          202.101.2.2     RD            1     IPSEC

        3          202.101.2.2     RD            2     IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO—TIMEOUT

 

2. IPSec SA status on the center:

disp ipsec sa

===============================

Interface: Serial2/0/0

    path MTU: 1500

===============================

 

  -----------------------------

  IPsec policy name: "center"

  sequence number: 10

  mode: isakmp

  -----------------------------

    connection id: 3

    encapsulation mode: tunnel

    perfect forward secrecy: None

    tunnel:

        local  address: 202.101.1.2

        remote address: 202.101.2.2

    flow:    (72 times matched)

        sour addr: 202.101.1.2/255.255.255.255  port: 0  protocol: GRE

        dest addr: 202.101.2.2/255.255.255.255  port: 0  protocol: GRE

 

    [inbound ESP SAs]

      spi: 1168206412 (0x45a16a4c)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887434028/3365

      max received sequence-number: 33   

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 2150942891 (0x8034c8ab)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887433260/3365

      max sent sequence-number: 36

      udp encapsulation used for nat traversal: N

 

  -----------------------------

  IPsec policy name: "center"

  sequence number: 20

  mode: isakmp

  -----------------------------

    connection id: 4

    encapsulation mode: tunnel

    perfect forward secrecy: None

    tunnel:

        local  address: 202.101.1.2

        remote address: 202.101.3.2

    flow:    (73 times matched)

        sour addr: 202.101.1.2/255.255.255.255  port: 0  protocol: GRE

        dest addr: 202.101.3.2/255.255.255.255  port: 0  protocol: GRE

 

    [inbound ESP SAs]                    

      spi: 2624895419 (0x9c74b9bb)       

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887433796/3385

      max received sequence-number: 35

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 1281853764 (0x4c678944)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887432856/3385

      max sent sequence-number: 39

      udp encapsulation used for nat traversal: N

 

3. Routing table on the center:

disp ip rout

 Routing Table: public net

Destination/Mask   Protocol Pre  Cost        Nexthop         Interface

0.0.0.0/0          STATIC   60   0           202.101.1.1     Serial2/0/0

1.1.1.1/32         DIRECT   0    0           127.0.0.1       InLoopBack0

2.2.2.2/32         OSPF     10   1563        10.0.0.2        Tunnel0

3.3.3.3/32         OSPF     10   1563        10.0.0.6        Tunnel1

10.0.0.0/30        DIRECT   0    0           10.0.0.1        Tunnel0

10.0.0.1/32        DIRECT   0    0           127.0.0.1       InLoopBack0

10.0.0.4/30        DIRECT   0    0           10.0.0.5        Tunnel1

10.0.0.5/32        DIRECT   0    0           127.0.0.1       InLoopBack0

127.0.0.0/8        DIRECT   0    0           127.0.0.1       InLoopBack0

127.0.0.1/32       DIRECT   0    0           127.0.0.1       InLoopBack0

192.168.1.0/24     DIRECT   0    0           192.168.1.1     LoopBack10

192.168.1.1/32     DIRECT   0    0           127.0.0.1       InLoopBack0

192.168.2.0/24     OSPF     10   1563        10.0.0.2        Tunnel0

192.168.3.0/24     OSPF     10   1563        10.0.0.6        Tunnel1

202.101.1.0/30     DIRECT   0    0           202.101.1.2     Serial2/0/0

202.101.1.1/32     DIRECT   0    0           202.101.1.1     Serial2/0/0

202.101.1.2/32     DIRECT   0    0           127.0.0.1       InLoopBack0

 

4. IKE SA status on branch 1:

disp ike sa

    connection-id  peer            flag        phase   doi

  ----------------------------------------------------------

        2          202.101.1.2     RD|ST         1     IPSEC

        3          202.101.1.2     RD|ST         2     IPSEC

 

  flag meaning

  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO—TIMEOUT

 

5. IPSec SA status on branch 1:

disp ipsec sa

===============================

Interface: Serial2/0/0

    path MTU: 1500

===============================

 

  -----------------------------

  IPsec policy name: "branch1"

  sequence number: 10

  mode: isakmp

  -----------------------------

    connection id: 3

    encapsulation mode: tunnel

    perfect forward secrecy: None

    tunnel:

        local  address: 202.101.2.2

        remote address: 202.101.1.2

    flow:    (82 times matched)

        sour addr: 202.101.2.2/255.255.255.255  port: 0  protocol: GRE

        dest addr: 202.101.1.2/255.255.255.255  port: 0  protocol: GRE

 

    [inbound ESP SAs]

      spi: 2150942891 (0x8034c8ab)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887433256/3293

      max received sequence-number: 42   

      udp encapsulation used for nat traversal: N

 

    [outbound ESP SAs]

      spi: 1168206412 (0x45a16a4c)

      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5

      sa remaining key duration (bytes/sec): 1887432880/3293

      max sent sequence-number: 41

      udp encapsulation used for nat traversal: N

 

6. Routing table on branch 1:

disp ip rout

 Routing Table: public net

Destination/Mask   Protocol Pre  Cost        Nexthop         Interface

0.0.0.0/0          STATIC   60   0           202.101.2.1     Serial2/0/0

1.1.1.1/32         OSPF     10   1563        10.0.0.1        Tunnel0

2.2.2.2/32         DIRECT   0    0           127.0.0.1       InLoopBack0

3.3.3.3/32         OSPF     10   3125        10.0.0.1        Tunnel0

10.0.0.0/30        DIRECT   0    0           10.0.0.2        Tunnel0

10.0.0.2/32        DIRECT   0    0           127.0.0.1       InLoopBack0

10.0.0.4/30        OSPF     10   3124        10.0.0.1        Tunnel0

127.0.0.0/8        DIRECT   0    0           127.0.0.1       InLoopBack0

127.0.0.1/32       DIRECT   0    0           127.0.0.1       InLoopBack0

192.168.1.0/24     OSPF     10   1563        10.0.0.1        Tunnel0

192.168.2.0/24     DIRECT   0    0           192.168.2.1     LoopBack10

192.168.2.1/32     DIRECT   0    0           127.0.0.1       InLoopBack0

192.168.3.0/24     OSPF     10   3125        10.0.0.1        Tunnel0

202.101.2.0/30     DIRECT   0    0           202.101.2.2     Serial2/0/0

202.101.2.1/32     DIRECT   0    0           202.101.2.1     Serial2/0/0

202.101.2.2/32     DIRECT   0    0           127.0.0.1       InLoopBack0

 

[Tip]

1. Differences between IPSec -Over-GRE and GRE-Over-IPSec in configuration:

 

	GRE-Over-IPSec	IPSec-Over-GRE
ACL definition	GRE data stream	Intranet data stream
Remote-address specified in IKE peer	Internet address of the peer	GRE tunnel address of the peer
Applied port	Internet egress	On the GRE tunnel

 

2. The branches interwork with the headquarters by OSPF routing. If OSPF is not configured, you need to configure static routes between the branches and the headquarters.

[Center configuration]

ip route-static 192.168.2.0 255.255.255.0 Tunnel 0 preference 60  /The data to the intranet of branch 1 goes through tunnel 0/

 ip route-static 192.168.3.0 255.255.255.0 Tunnel 1 preference 60  /The data to the intranet of branch 2 goes through tunnel 1/

 

[Branch 1 configuration]

 ip route-static 192.168.1.0 255.255.255.0 Tunnel 0 preference 60    /The data to the intranet of the center goes through tunnel 0/

 

[Branch 2 configuration]

 ip route-static 192.168.1.0 255.255.255.0 Tunnel 0 preference 60    /The data to the intranet of the center goes through tunnel 0/