Configure a GRE IPsec site to site VPN Tunnel between 2 Cisco Routers

gns3 topology2

Step 1: IKE/ISAKMP configuration

Our first task in creating an IPsec tunnel is specifying an Internet Key Exchange (IKE) policy. IKE relies on ISAKMP to establish an initial secure channel over which the IPsec tunnel can be negotiated. An IKE policy determines the attributes of the ISAKMP session, including the encryption type and hashing methods.

crypto isakmp policy 1
encryption 3des
authentication pre-share
group 2

You can run this show command to check the encryption settings of the policy:

R1#show crypto isakmp policy

Global IKE policy
Protection suite of priority 1
encryption algorithm: Three key triple DES
hash algorithm: Secure Hash Standard
authentication method: Pre-Shared Key
Diffie-Hellman group: #2 (1024 bit)
lifetime: 86400 seconds, no volume limit

next we define a pre-shared key. The key is a string of text used to initialize the IKE tunnel, configured identically on both routers:

crypto isakmp key B8PhgA8Aod address no-xauth

You can run this show command to verify the key association:

R1#show crypto isakmp sa


Step 2: Create GRE Tunnel

interface tunnel6
Description R1 to R2
ip address
ip virtual re-assembly
cdp enable
tunnel source
tunnel destination

We can enable CDP (Cisco Discovery Protocol) to see if the connection is made to the remote end

Configure the router at the other end with inverse settings

Step 3: IPSec configuration

Once our IKE policy has been setup we can move on to defining an IPsec transform set. The transform set defines the parameters of the IPsec security associations which will carry the actual data.

Unlike defining an IKE policy, which provides a default for all attributes, we must explicitly state the encryption and hash type we want to use with our transform set. Our example will implement ESP encapsulation with 3DES encryption and SHA-1 authentication. Within transform set configuration, we have the option to select tunnel or transport mode; tunnel mode is the default.

crypto ipsec transform-set Test esp-3des esp-sha-hmac

R1#show crypto ipsec transform-set
Transform set Test: { esp-3des esp-sha-hmac }
will negotiate = { Tunnel, },

Now that we have our IPsec transform set created, we can reference it from an IPsec profile to be applied to a tunnel interface:

crypto ipsec profile TestVPN
set transform-set Test

R1#show crypto ipsec profile


Our last step is to convert the tunnel interfaces on routers 1 and 2 to IPsec operation. First we change the tunnel mode from GRE to IPsec for IPv4, then apply our IPsec profile:

Int tunnel6
tunnel mode ipsec ipv4
tunnel protection ipsec profile TestVPN

R2#show crypto engine connections active


R1#show crypto ipsec sa

show sa

If you are having any issues you can clear the security association with this command:

clear crypto sa peer

Further diagrams and reading:

main mode

key terms

ike exchange phase 1

ike exchange phase 2

Posted in Cisco, Networking

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: