• Chapter 1: Describing Network Requirements
• Chapter 2: Topologies for Teleworker Connectivity
• Chapter 3: Using Cable to Connect to a Central Site
• Chapter 4: Using DSL to Connect to a Central Site
• Chapter 5: Configuring DSL Access with PPPoE
• Chapter 6: Configuring DSL Access with PPPoA
• Chapter 7: DSL Connection Troubleshooting
• Chapter 8: The MPLS Conceptual Model
• Chapter 9: MPLS Architecture
• Chapter 10: Configuring Frame Mode MPLS
• Chapter 11: MPLS VPN Technologies
• Chapter 12: IPsec Overview
• Chapter 13: Site-to-Site VPN Operations
• Chapter 14: GRE Tunneling over IPsec
• Chapter 15: IPsec High Availability Options
• Chapter 16: Configuring Cisco Easy VPN
• Chapter 18: Cisco Device Hardening
• Chapter 19: Securing Administrative Access
• Chapter 20: Using AAA to Scale Access Control
• Chapter 21: Cisco IOS Threat Defense Features
• Chapter 22: Implementing Cisco IOS Firewalls
• Chapter 23: Implementing Cisco IDS and IPS

Chapter 14: GRE Tunneling over IPsec

GRE over IPsec is primarily used to facilitate routing protocols within tunnels.

GRE is stateless.

GRE adds a new 20-byte IP header and its own 4-byte header, and up to 12 bytes of options:

• Bit 0: Checksum present - Adds an optional 4-byte checksum field
• Bit 2: Key present - Adds an optional 4-byte encryption key
• Bit 3: Sequence number present - Adds an optional 4-byte sequence number
• Bits 13-15: GRE version - 0 is basic GRE, 1 is used for PPTP
• Bits 16-31: Protocol field - Identifies layer 3 protocol being transported

GRE Tunnel Configuration

Basic configuration components:

• Tunnel source
• Tunnel destination
• Tunnel mode (GRE/IP is default)

Basic GRE/IP configuration:

Router(config)# interface tunnel0
Router(config-if)# ip address 192.168.0.1 255.255.255.252
Router(config-if)# tunnel source s0/0
Router(config-if)# tunnel destination 10.1.2.3
! GRE/IP is default
Router(config-if)# tunnel mode gre ip

GRE over IPsec configuration under the SDM involves the following steps:

1. Create the GRE tunnel
2. Create a backup GRE tunnel (optional)
3. Select the IPsec VPN authentication method
4. Select the IPsec VPN IKE proposals
5. Select the IPsec VPN transform sets
6. Select the routing method for the tunnel
7. Validate the configuration