Lab 7.2.2.5 - Configuring A Point-to-Point GRE VPN Tunnel: Topology
Lab 7.2.2.5 - Configuring A Point-to-Point GRE VPN Tunnel: Topology
Lab 7.2.2.5 - Configuring A Point-to-Point GRE VPN Tunnel: Topology
Addressing Table
Objectives
Part 1: Configure Basic Device Settings
Part 2: Configure a GRE Tunnel
Part 3: Enable Routing over the GRE Tunnel
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
Background / Scenario
Generic Routing Encapsulation (GRE) is a tunneling protocol that can encapsulate a variety of network layer
protocols between two locations over a public network, such as the Internet.
GRE can be used with:
- Connecting IPv6 networks over IPv4 networks
- Multicast packets, such as OSPF, EIGRP, and streaming applications
In this lab, you will configure an unencrypted point-to-point GRE VPN tunnel and verify that network traffic is
using the tunnel. You will also configure the OSPF routing protocol inside the GRE VPN tunnel. The GRE
tunnel is between the WEST and EAST routers in OSPF area 0. The ISP has no knowledge of the GRE
tunnel. Communication between the WEST and EAST routers and the ISP is accomplished using default
static routes.
Note: The routers used with CCNA hands-on labs are Cisco 1941 Integrated Services Routers (ISRs) with
Cisco IOS Release 15.2(4)M3 (universalk9 image). The switches used are Cisco Catalyst 2960s with Cisco
IOS Release 15.0(2) (lanbasek9 image). Other routers, switches, and Cisco IOS versions can be used.
Depending on the model and Cisco IOS version, the commands available and output produced might vary
from what is shown in the labs. Refer to the Router Interface Summary Table at the end of this lab for the
correct interface identifiers.
Note: Make sure that the routers and switches have been erased and have no startup configurations. If you
are unsure, contact your instructor.
Required Resources
3 Routers (Cisco 1941 with Cisco IOS Release 15.2(4)M3 universal image or comparable)
2 Switches (Cisco 2960 with Cisco IOS Release 15.0(2) lanbasek9 image or comparable)
2 PCs (Windows 7, Vista, or XP with terminal emulation program, such as Tera Term)
Console cables to configure the Cisco IOS devices via the console ports
Ethernet and serial cables as shown in the topology
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
h. Apply IP addresses to Serial and Gigabit Ethernet interfaces according to the Addressing Table and
activate the physical interfaces. Do NOT configure the Tunnel0 interfaces at this time.
i. Set the clock rate to 128000 for DCE serial interfaces.
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 4 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 5 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
Reflection
1. What other configurations are needed to create a secured GRE tunnel?
_______________________________________________________________________________________
2. If you added more LANs to the WEST or EAST router, what would you need to do so that the network will use
the GRE tunnel for traffic?
_______________________________________________________________________________________
Router Model Ethernet Interface #1 Ethernet Interface #2 Serial Interface #1 Serial Interface #2
1800 Fast Ethernet 0/0 Fast Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(F0/0) (F0/1)
1900 Gigabit Ethernet 0/0 Gigabit Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(G0/0) (G0/1)
2801 Fast Ethernet 0/0 Fast Ethernet 0/1 Serial 0/1/0 (S0/1/0) Serial 0/1/1 (S0/1/1)
(F0/0) (F0/1)
2811 Fast Ethernet 0/0 Fast Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(F0/0) (F0/1)
2900 Gigabit Ethernet 0/0 Gigabit Ethernet 0/1 Serial 0/0/0 (S0/0/0) Serial 0/0/1 (S0/0/1)
(G0/0) (G0/1)
Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many
interfaces the router has. There is no way to effectively list all the combinations of configurations for each router
class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device.
The table does not include any other type of interface, even though a specific router may contain one. An
example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be
used in Cisco IOS commands to represent the interface.
Device Configs
Router WEST
WEST# show run
Building configuration...
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 6 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname WEST
!
boot-start-marker
boot-end-marker
!
!
enable secret 4 06YFDUHH61wAE/kLkDq9BGho1QM5EnRtoyr8cHAUg.2
!
no aaa new-model
memory-size iomem 15
!
ip cef
!
!
!
!
!
!
no ip domain lookup
no ipv6 cef
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
interface Tunnel0
ip address 172.16.12.1 255.255.255.252
tunnel source Serial0/0/0
tunnel destination 10.2.2.1
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
shutdown
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 7 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 172.16.1.1 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0/0
ip address 10.1.1.1 255.255.255.252
clock rate 128000
!
interface Serial0/0/1
no ip address
shutdown
!
router ospf 1
network 172.16.1.0 0.0.0.255 area 0
network 172.16.12.0 0.0.0.3 area 0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 10.1.1.2
!
!
!
!
control-plane
!
!
banner motd ^C
Unauthorized Access Prohibited.
^C
!
line con 0
password 7 14141B180F0B
logging synchronous
login
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 8 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
line vty 0 4
password 7 05080F1C2243
login
transport input all
!
scheduler allocate 20000 1000
!
end
Router ISP
ISP# show run
Building configuration...
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 9 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0/0
ip address 10.1.1.2 255.255.255.252
!
interface Serial0/0/1
ip address 10.2.2.2 255.255.255.252
clock rate 128000
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
!
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 10 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
banner motd ^C
Unauthorized Access Prohibited.
^C
!
line con 0
password 7 02050D480809
logging synchronous
login
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password 7 045802150C2E
login
transport input all
!
scheduler allocate 20000 1000
!
end
Router EAST
EAST# show run
Building configuration...
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 11 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
!
!
!
!
!
!
no ip domain lookup
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
redundancy
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Tunnel0
ip address 172.16.12.2 255.255.255.252
tunnel source 10.2.2.1
tunnel destination 10.1.1.1
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 172.16.2.1 255.255.255.0
duplex auto
speed auto
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 12 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
!
interface Serial0/0/0
no ip address
shutdown
clock rate 2000000
!
interface Serial0/0/1
ip address 10.2.2.1 255.255.255.252
!
router ospf 1
network 172.16.2.0 0.0.0.255 area 0
network 172.16.12.0 0.0.0.3 area 0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 10.2.2.2
!
!
!
!
control-plane
!
!
banner motd ^C
Unauthorized Access Prohibited.
^C
!
line con 0
password 7 00071A150754
logging synchronous
login
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
password 7 030752180500
login
transport input all
!
scheduler allocate 20000 1000
!
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 13 of 14
Lab Configuring a Point-to-Point GRE VPN Tunnel
end
2013 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 14 of 14