IPSec over GRE Tunnel:

Advantages:

 Will create a logical virtual interface between the two routers that the traffic will appear to flow across
 Allows us to run a IGP routing protocol
 Allows Multicast Routing
 Encrypted Traffic going through the Internet

Pre-Configuration:

 ASA
!
interface GigabitEthernet0
ip address 100.100.100.2 255.255.255.0
nameif outside
security-level 0
no shutdown
!
!
interface GigabitEthernet2
ip address 10.10.10.1 255.255.255.252
nameif inside
security-level 100
no shutdown

 Corp
!
interface FastEthernet 0/0
ip address 10.10.10.2 255.255.255.252
no shutdown
interface FastEthernet 0/1
ip address 10.10.11.1 255.255.255.252
no shutdown

 Branch
!
interface FastEthernet 0/0
ip address 100.100.100.10 255.255.255.0
no shutdown
!
interface FastEthernet 0/1
ip address 10.10.14.1 255.255.255.252
no shutdown

 ASA
!
interface GigabitEthernet1
 no nameif
security-level 0
no ip address
no shut
!
interface GigabitEthernet1.1
nameif DMZ
security-level 50
ip address 20.20.20.1 255.255.255.0

 SW1
vlan database
vlan 10 name DMZ
exit
conf t
!
no ip routing
!
int fa1/0
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface range FastEthernet 1/1 - 2
switchport mode access
switchport access vlan 10
!
ip default-gateway 20.20.20.1

 SW2
!
vlan database
vlan 2 name Sales
vlan 3 name Finance
exit
conf t
!
interface FastEthernet 1/0
switchport mode access
switchport access vlan 2
spanning-tree portfast
!
interface FastEthernet 1/1
switchport mode access
switchport access vlan 3
spanning-tree portfast
!
interface vlan 2
ip address 10.10.12.1 255.255.255.0
no shut
!
interface vlan 3
ip address 10.10.13.1 255.255.255.0
no shut
!
interface FastEthernet 0/0
ip address 10.10.11.2 255.255.255.252
no shut
!
ip dhcp excluded-address 10.10.12.1 10.10.12.9
!
ip dhcp pool VLAN2
network 10.10.12.0 /24
default-router 10.10.12.1
dns-server 8.8.8.8
!
ip dhcp excluded-address 10.10.13.1 10.10.13.9
!
ip dhcp pool VLAN3
network 10.10.13.0 /24
default-router 10.10.13.1
dns-server 8.8.8.8

 SW3
!
vlan database
 vlan 2 name Accounting
vlan 3 name Management
exit
conf t
!
interface FastEthernet 1/0
switchport mode access
switchport access vlan 2
spanning-tree portfast
!
interface FastEthernet 1/1
switchport mode access
switchport access vlan 3
spanning-tree portfast
!
interface vlan 2
ip address 10.10.15.1 255.255.255.0
no shut
!
interface vlan 3
ip address 10.10.16.1 255.255.255.0
no shut
!
interface FastEthernet 0/0
ip address 10.10.14.2 255.255.255.252
no shut
!
ip dhcp excluded-address 10.10.15.1 10.10.15.9
!
ip dhcp pool VLAN2
network 10.10.15.0 /24
default-router 10.10.15.1
dns-server 8.8.8.8
!
ip dhcp excluded-address 10.10.16.1 10.10.16.9
!
ip dhcp pool VLAN3
network 10.10.16.0 /24
default-router 10.10.16.1
dns-server 8.8.8.8

Advantages:

 Will create a logical virtual interface between the two routers that the traffic will appear to flow across
 Allows us to run a IGP routing protocol
 Allows Multicast Routing
 Encrypted Traffic going through the Internet

Configuration GRE Tunnel:

Step 1: Create OSPF routing process:

 CORP(config)# router ospf 123

CORP(config-router)# network 192.168.1.0 0.0.0.255 area 0

 BRANCH(config)# router ospf 123

BRANCH(config-router)# network 10.1.1.0 0.0.0.255 area 0

Step 2: Configure layer 3 tunnel interfaces:

 CORP(config)# interface tunnel 0

CORP(config-if)# tunnel source f0/0
CORP(config-if)# tunnel destination 192.168.137.10
CORP(config-if)# ip address 10.10.1.1 255.255.255.252
CORP(config-if)# tunnel path-mtu-discovery
CORP(config-if)# ip ospf mtu-ignore

 BRANCH(config)# interface tunnel 0

BRANCH(config-if)# tunnel source f0/0
BRANCH(config-if)# tunnel destination 192.168.137.2
BRANCH(config-if)# ip address 10.10.1.2 255.255.255.252
BRANCH(config-if)# tunnel path-mtu-discovery
BRANCH(config-if)# ip ospf mtu-ignore
Verify:

 CORP# ping 10.10.1.2

Step 3: Update OSPF Network Statements:

 CORP(config)# router ospf 123

 CORP(config-router)# network 10.10.1.0 0.0.0.3 area 0

 BRANCH(config)# router ospf 123

 BRANCH(config-router)# network 10.10.1.0 0.0.0.3 area 0

Verify:

 CORP# show ip ospf neighbor

Configure IPSec:

Step 1: Define Traffic to be encrypted

 CORP(config)# ip access-list extended IPSEC-TRAFFIC

CORP(config-ext-nacl)# remark VPN Traffic
CORP(config-ext-nacl)# permit gre host 192.168.137.2 host 192.168.137.10

 BRANCH(config)# ip access-list extended IPSEC-TRAFFIC

BRANCH(config-ext-nacl)# remark VPN Traffic
BRANCH(config-ext-nacl)# permit gre host 192.168.137.10 host 192.168.137.2

Step 2: Phase 1: Isakmp policy

 CORP(config)# crypto isakmp policy 1

CORP(config-isakmp)# authentication pre-share
CORP(config-isakmp)# encryption aes 128
CORP(config-isakmp)# hash sha
CORP(config-isakmp)# group 2

 BRANCH(config)# crypto isakmp policy 1

BRANCH(config-isakmp)# authentication pre-share
BRANCH(config-isakmp)# encryption aes 128
BRANCH(config-isakmp)# hash sha
BRANCH(config-isakmp)# group 2

Step 3: Define Shared Secret

 CORP(config)# crypto isakmp key 0 CISCO address 192.168.137.10

 BRANCH(config)# crypto isakmp key 0 CISCO address 192.168.137.2

Step 4: Phase 2: IPSec transform set

 CORP(config)# crypto ipsec transform-set TRANS-SET-GRE-TUNNEL esp-aes 128 esp-sha-hmac

CORP(cfg-crypto-trans)# mode tunnel

 BRANCH(config)# crypto ipsec transform-set TRANS-SET-GRE-TUNNEL esp-aes 128 esp-sha-hmac

BRANCH(cfg-crypto-trans)# mode tunnel

Step 5: Create crypto-map

 CORP(config)# crypto map CRYPTO-MAP 1 ipsec-isakmp

CORP(config-crypto-map)# description to BRANCH
CORP(config-crypto-map)# match address IPSEC-TRAFFIC
CORP(config-crypto-map)# set peer 192.168.137.10
CORP(config-crypto-map)# set transform-set TRANS-SET-GRE-TUNNEL

 BRANCH(config)# crypto map CRYPTO-MAP 1 ipsec-isakmp

BRANCH(config-crypto-map)# description to CORP
BRANCH(config-crypto-map)# match address IPSEC-TRAFFIC
BRANCH(config-crypto-map)# set peer 192.168.137.2
BRANCH(config-crypto-map)# set transform-set TRANS-SET-GRE-TUNNEL

Step 6: Apply crypto-map to interfaces

 CORP(config)# interface f0/0

CORP(config-if)# crypto map CRYPTO-MAP
 CORP(config-if)# interface tunnel 0
 CORP(config-if)# crypto map CRYPTO-MAP

 BRANCH(config)# interface f0/0

BRANCH(config-if)# crypto map CRYPTO-MAP
 BRANCH(config-if)# interface tunnel 0
BRANCH(config-if)# crypto map CRYPTO-MAP

Step 7: Verification

CORP# show ip ospf neighbor

CORP# show crypto ipsec sa
CORP# ping 10.10.1.2 repeat 50