LogoفارسیFA

Hands-On Lab: Configuring GRE over IPsec

This hands-on lab combines a GRE tunnel with IPsec encryption, allowing a dynamic routing protocol to run across an encrypted link between two sites, something a plain IPsec VPN alone cannot support directly.

GRE over IPsecTunnel ProtectionDynamic Routing Over VPN

~4 min read · Updated Sep 23, 2026

Lab Objective

Configure a GRE tunnel between two routers, protect it with IPsec using tunnel protection, and run OSPF across the resulting encrypted tunnel interface, verifying both encryption and dynamic route exchange work together.

Lab Purpose

The plain site-to-site IPsec VPN configured in the previous lab can only encrypt traffic matching a static interesting-traffic ACL — it cannot carry a dynamic routing protocol's multicast or broadcast traffic. GRE over IPsec solves this by first creating a GRE tunnel, discussed earlier in this series, that behaves like a normal point-to-point interface capable of running any protocol, then encrypting everything that tunnel carries.

Lab Topology

R1 (Site A) ---- Gi0/1 ---- ISP ---- Gi0/1 ---- R2 (Site B)

R1: Gi0/0 (LAN) 192.168.150.0/24, Gi0/1 (WAN) 203.0.113.9/30
R2: Gi0/0 (LAN) 192.168.160.0/24, Gi0/1 (WAN) 203.0.113.13/30

Tunnel0 on R1: 172.16.100.1/30
Tunnel0 on R2: 172.16.100.2/30

Task 1: Configure Basic Addressing

Configure both routers' LAN and WAN interfaces.

Task 2: Configure the GRE Tunnel

Create Tunnel0 on both routers with the addresses shown, sourced and destined at each router's WAN address.

Task 3: Configure IKE Phase 1 and IPsec Transform Set

Configure matching ISAKMP policy, pre-shared key, and transform set on both routers.

Task 4: Create an IPsec Profile and Apply Tunnel Protection

Create an IPsec profile referencing the transform set, then apply it directly to the tunnel interface using tunnel protection.

Task 5: Configure OSPF Across the Tunnel

Enable OSPF on both routers, including the tunnel interface and each LAN.

Task 6: Verify Encryption and Dynamic Routing Both Work

Confirm the OSPF neighbor forms across the tunnel and that IPsec security associations show active encrypted traffic.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.150.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ip address 203.0.113.9 255.255.255.252
R1(config-if)# no shutdown

R2(config)# interface gigabitethernet0/0
R2(config-if)# ip address 192.168.160.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface gigabitethernet0/1
R2(config-if)# ip address 203.0.113.13 255.255.255.252
R2(config-if)# no shutdown

R1(config)# interface tunnel0
R1(config-if)# tunnel source 203.0.113.9
R1(config-if)# tunnel destination 203.0.113.13
R1(config-if)# ip address 172.16.100.1 255.255.255.252

R2(config)# interface tunnel0
R2(config-if)# tunnel source 203.0.113.13
R2(config-if)# tunnel destination 203.0.113.9
R2(config-if)# ip address 172.16.100.2 255.255.255.252

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# authentication pre-share
R1(config)# crypto isakmp key GreVpnKey2026 address 203.0.113.13
R1(config)# crypto ipsec transform-set GRE-SET esp-aes 256 esp-sha256-hmac

R2(config)# crypto isakmp policy 10
R2(config-isakmp)# encryption aes 256
R2(config-isakmp)# authentication pre-share
R2(config)# crypto isakmp key GreVpnKey2026 address 203.0.113.9
R2(config)# crypto ipsec transform-set GRE-SET esp-aes 256 esp-sha256-hmac

R1(config)# crypto ipsec profile GRE-PROTECT
R1(ipsec-profile)# set transform-set GRE-SET
R1(config)# interface tunnel0
R1(config-if)# tunnel protection ipsec profile GRE-PROTECT

-- Unlike the crypto map approach in the
-- previous lab, tunnel protection is applied
-- directly on the tunnel interface itself --
-- no separate interesting-traffic ACL is
-- needed, since ALL traffic entering the
-- tunnel is automatically protected

R2(config)# crypto ipsec profile GRE-PROTECT
R2(ipsec-profile)# set transform-set GRE-SET
R2(config)# interface tunnel0
R2(config-if)# tunnel protection ipsec profile GRE-PROTECT

R1(config)# router ospf 1
R1(config-router)# network 172.16.100.0 0.0.0.3 area 0
R1(config-router)# network 192.168.150.0 0.0.0.255 area 0

R2(config)# router ospf 1
R2(config-router)# network 172.16.100.0 0.0.0.3 area 0
R2(config-router)# network 192.168.160.0 0.0.0.255 area 0

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Interface
2.2.2.2          1     FULL/  -        Tunnel0
-- The OSPF neighbor formed directly across
-- the GRE tunnel, something the plain
-- interesting-traffic-ACL VPN from the
-- previous lab could never support

R1# show crypto ipsec sa | include encaps|decaps

    #pkts encaps: 142, #pkts encrypt: 142
    #pkts decaps: 138, #pkts decrypt: 138
-- Confirms the OSPF hello/update traffic
-- itself is being encrypted, not just
-- bypassing protection through the tunnel

Key Takeaway

Tunnel protection ipsec profile fundamentally changes how encryption is scoped compared to a crypto map: rather than a static ACL deciding which specific traffic gets encrypted, everything entering the GRE tunnel interface is automatically protected — this is precisely what allows OSPF's multicast hello traffic, which a static interesting-traffic ACL was never designed to match, to be encrypted along with regular data traffic.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring HSRP for IPv6

This hands-on lab configures HSRP for IPv6 between two routers, demonstrating the option to use an automatically generated link-local virtual address rather than manually assigning one, and verifies failover behavior mirrors the IPv4 HSRP lab covered earlier in this series.

Continue

Hands-On Lab: Configuring SVI Autostate Exclude

This hands-on lab configures SVI autostate exclude on a monitoring port within a VLAN, preventing that single inactive port from incorrectly bringing down the SVI for an entire VLAN that still has other active member ports.

Continue

Hands-On Lab: Configuring Private VLANs (PVLANs)

This hands-on lab configures a full Private VLAN structure with a primary VLAN and both isolated and community secondary VLANs, demonstrating fine-grained Layer 2 isolation within a single IP subnet beyond what the simple protected-port feature from an earlier lab can achieve.

Continue

Hands-On Lab: Configuring VLAN Access Control Lists (VACLs)

This hands-on lab configures a VLAN Access Control List using a VLAN access-map to filter traffic within a single VLAN at Layer 2, something a standard router-applied ACL cannot achieve since traffic never leaves the VLAN to reach a routed interface.

Continue

Hands-On Lab: Configuring Storm Control

This hands-on lab configures storm control thresholds on a switch port to limit broadcast and multicast traffic, simulating a broadcast storm and verifying the switch suppresses excess traffic before it can overwhelm the network.

Continue

Hands-On Lab: Configuring PVLAN Edge (Protected Ports)

This hands-on lab configures PVLAN Edge (protected ports) on two access ports within the same VLAN, isolating them from each other at Layer 2 while both retain normal connectivity to an uplink port, demonstrating a lightweight isolation feature that requires no separate VLAN.

Continue
Previous ArticleNext Article