Hands-On Lab: Configuring GRE over IPsec

Lab Objective

Configure a GRE tunnel between two routers, protect it with IPsec using tunnel protection, and run OSPF across the resulting encrypted tunnel interface, verifying both encryption and dynamic route exchange work together.

Lab Purpose

The plain site-to-site IPsec VPN configured in the previous lab can only encrypt traffic matching a static interesting-traffic ACL — it cannot carry a dynamic routing protocol's multicast or broadcast traffic. GRE over IPsec solves this by first creating a GRE tunnel, discussed earlier in this series, that behaves like a normal point-to-point interface capable of running any protocol, then encrypting everything that tunnel carries.

Lab Topology

R1 (Site A) ---- Gi0/1 ---- ISP ---- Gi0/1 ---- R2 (Site B)

R1: Gi0/0 (LAN) 192.168.150.0/24, Gi0/1 (WAN) 203.0.113.9/30
R2: Gi0/0 (LAN) 192.168.160.0/24, Gi0/1 (WAN) 203.0.113.13/30

Tunnel0 on R1: 172.16.100.1/30
Tunnel0 on R2: 172.16.100.2/30

Task 1: Configure Basic Addressing

Configure both routers' LAN and WAN interfaces.

Task 2: Configure the GRE Tunnel

Create Tunnel0 on both routers with the addresses shown, sourced and destined at each router's WAN address.

Task 3: Configure IKE Phase 1 and IPsec Transform Set

Configure matching ISAKMP policy, pre-shared key, and transform set on both routers.

Task 4: Create an IPsec Profile and Apply Tunnel Protection

Create an IPsec profile referencing the transform set, then apply it directly to the tunnel interface using tunnel protection.

Task 5: Configure OSPF Across the Tunnel

Enable OSPF on both routers, including the tunnel interface and each LAN.

Task 6: Verify Encryption and Dynamic Routing Both Work

Confirm the OSPF neighbor forms across the tunnel and that IPsec security associations show active encrypted traffic.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.150.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ip address 203.0.113.9 255.255.255.252
R1(config-if)# no shutdown

R2(config)# interface gigabitethernet0/0
R2(config-if)# ip address 192.168.160.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface gigabitethernet0/1
R2(config-if)# ip address 203.0.113.13 255.255.255.252
R2(config-if)# no shutdown

R1(config)# interface tunnel0
R1(config-if)# tunnel source 203.0.113.9
R1(config-if)# tunnel destination 203.0.113.13
R1(config-if)# ip address 172.16.100.1 255.255.255.252

R2(config)# interface tunnel0
R2(config-if)# tunnel source 203.0.113.13
R2(config-if)# tunnel destination 203.0.113.9
R2(config-if)# ip address 172.16.100.2 255.255.255.252

R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# authentication pre-share
R1(config)# crypto isakmp key GreVpnKey2026 address 203.0.113.13
R1(config)# crypto ipsec transform-set GRE-SET esp-aes 256 esp-sha256-hmac

R2(config)# crypto isakmp policy 10
R2(config-isakmp)# encryption aes 256
R2(config-isakmp)# authentication pre-share
R2(config)# crypto isakmp key GreVpnKey2026 address 203.0.113.9
R2(config)# crypto ipsec transform-set GRE-SET esp-aes 256 esp-sha256-hmac

R1(config)# crypto ipsec profile GRE-PROTECT
R1(ipsec-profile)# set transform-set GRE-SET
R1(config)# interface tunnel0
R1(config-if)# tunnel protection ipsec profile GRE-PROTECT

-- Unlike the crypto map approach in the
-- previous lab, tunnel protection is applied
-- directly on the tunnel interface itself --
-- no separate interesting-traffic ACL is
-- needed, since ALL traffic entering the
-- tunnel is automatically protected

R2(config)# crypto ipsec profile GRE-PROTECT
R2(ipsec-profile)# set transform-set GRE-SET
R2(config)# interface tunnel0
R2(config-if)# tunnel protection ipsec profile GRE-PROTECT

R1(config)# router ospf 1
R1(config-router)# network 172.16.100.0 0.0.0.3 area 0
R1(config-router)# network 192.168.150.0 0.0.0.255 area 0

R2(config)# router ospf 1
R2(config-router)# network 172.16.100.0 0.0.0.3 area 0
R2(config-router)# network 192.168.160.0 0.0.0.255 area 0

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Interface
2.2.2.2          1     FULL/  -        Tunnel0
-- The OSPF neighbor formed directly across
-- the GRE tunnel, something the plain
-- interesting-traffic-ACL VPN from the
-- previous lab could never support

R1# show crypto ipsec sa | include encaps|decaps

    #pkts encaps: 142, #pkts encrypt: 142
    #pkts decaps: 138, #pkts decrypt: 138
-- Confirms the OSPF hello/update traffic
-- itself is being encrypted, not just
-- bypassing protection through the tunnel

Key Takeaway

Tunnel protection ipsec profile fundamentally changes how encryption is scoped compared to a crypto map: rather than a static ACL deciding which specific traffic gets encrypted, everything entering the GRE tunnel interface is automatically protected — this is precisely what allows OSPF's multicast hello traffic, which a static interesting-traffic ACL was never designed to match, to be encrypted along with regular data traffic.