gre instead of virtual link...

http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00801ec9ee.shtml#using

this is borderline trivia, and i think bad design, however... a very good reason to not use a vl is due to the DNA (do not age) or no dead timer...

gre tunnel config...

in the ccie r&s cert guide wendell uses a configuration example whereby the source is a source interface, and the destination is an ip address... i can't imagine that this is some kind of best practice situation... at the end of this chapter he restates the configuration commands where again, the source for the tunnel is an interface, ie, loopback 0 (as if there are no other choices, see below), and the destination is an ip address...  i'm not clear why he is insistent on this point...

perhaps you save some typing, i don't know...  i like to always use an ip address for both source and destination... 

these are the facts...

DLS1(config-if)#tunn source ?
  A.B.C.D            ip address
  Async              Async interface
  Auto-Template      Auto-Template interface
  BVI                Bridge-Group Virtual Interface
  CTunnel            CTunnel interface
  Dialer             Dialer interface
  FastEthernet       FastEthernet IEEE 802.3
  Filter             Filter interface
  Filtergroup        Filter Group interface
  GigabitEthernet    GigabitEthernet IEEE 802.3z
  GroupVI            Group Virtual interface
  Lex                Lex interface
  Loopback           Loopback interface
  Null               Null interface
  Port-channel       Ethernet Channel of interfaces
  Portgroup          Portgroup interface
  Pos-channel        POS Channel of interfaces
  Tunnel             Tunnel interface
  Vif                PGM Multicast Host interface
  Virtual-Template   Virtual Template interface
  Virtual-TokenRing  Virtual TokenRing
  Vlan               Catalyst Vlans
  X:X:X:X::X         IPv6 address
  fcpa               Fiber Channel

so given a configuration task would it be incorrect if the question stated "use the loopback" as the tunnel source, and you used the ip address of the loopback instead...

for me they are equivalent...

gre with crypto...

you have the tunnel from the previous post, now lock it up...

crypto isakmp policy ?
encry 3des
hash md5
authenti pre-share
group 2
lifetime ?

crypto isakmp sets up the policy
3des (triple des) is the encryption method (strong)
md5 (message digest 5) is the hash
pre-shared key is the authentication method
group 2 is the diffie-hellman group
and 86400 is the key's session lifetime

crypto isakmp key suck-key add 1.1.1.2

reverse the address on the peer
this is the key shared with 1.1.1.2

a transform set is needed for data protection, we can call it tset

crypto ipsec transform-set tset esp-3des esp-md5-hmac
mode transport

next associate an ipsec profile to the transform set

crypto ipsec profile gre-lock
set security-association lifetime seconds 86400
set transform-set tset

apply it to the tunnel

int tun 0
tunnel protection ipsec profile gre-lock

do the same for the peer


i1(config)#crypto isakmp policy ?
  <1 -10000="-10000">  Priority of protection suite

i1(config)#crypto isakmp policy 1
i1(config-isakmp)#encry 3des
i1(config-isakmp)#hash md5
i1(config-isakmp)#authenti pre-share
i1(config-isakmp)#group 2
i1(config-isakmp)#lifetime ?
  <60 -86400="-86400">  lifetime in seconds

i1(config-isakmp)#lifetime 86400
i1(config-isakmp)#exit
i1(config)#crypto isakmp key suck-key add 1.1.1.2
i1(config)#crypto ipsec transform-set tset esp-3des esp-md5-hmac
i1(cfg-crypto-trans)#mode transport
i1(cfg-crypto-trans)#crypto ipsec profile gre-lock
i1(ipsec-profile)#set security-association lifetime seconds 86400
i1(ipsec-profile)#set transform-set tset
i1(ipsec-profile)#exit
i1(config)#int tun 0
i1(config-if)#tunnel protection ipsec profile gre-lock
i1(config-if)#
*Aug 18 06:35:13: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
i1(config-if)#end
i1#
*Aug 18 06:37:38: %SYS-5-CONFIG_I: Configured from console by console
i1#ping 192.168.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/17/36 ms
i1#sh crypto session
Crypto session current status

Interface: Tunnel0
Session status: UP-ACTIVE    
Peer: 1.1.1.2 port 500
  IKEv1 SA: local 1.1.1.1/500 remote 1.1.1.2/500 Active
  IPSEC FLOW: permit 47 host 1.1.1.1 host 1.1.1.2
        Active SAs: 2, origin: crypto map


push...  uuuuuuuuuuuunnnhhh... you just gave birth to a simple vpn... how'd that feel...

gre...

generic route encapsulation...

2 routers directly connected, 2 hosts connected to each, 3 subnets and no routing protocols, well, ip...

i1#sh ip proto
*** IP Routing is NSF aware ***

i1 connects to i2 with 1.1.1.1/24 and 1.1.1.2/24

i2#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/12 ms

we can tunnel between the two successfully by setting up tunnel interfaces on both sides...

i1#sh run int tun 0
Building configuration...

Current configuration : 113 bytes
!
interface Tunnel0
 ip address 172.16.1.1 255.255.255.0
 tunnel source 1.1.1.1
 tunnel destination 1.1.1.2

i2#sh run int tun 0
Building configuration...

Current configuration : 113 bytes
!
interface Tunnel0
 ip address 172.16.1.2 255.255.255.0
 tunnel source 1.1.1.2
 tunnel destination 1.1.1.1

we note that the tunnels are on a completely different subnet and are not being routed...

i2#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/12 ms

sheer trickery...

i believe that it is being tunneled because wireshark tells me so...

i1#sh ip route | excl L | incl Loop

      omitted

Gateway of last resort is not set

      1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        1.1.1.0/24 is directly connected, FastEthernet0/1

      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks

C        172.16.1.0/24 is directly connected, Tunnel0

      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks

C        192.168.1.0/24 is directly connected, FastEthernet0/0

lets use the tunnel to get from one host all the way to the other...

i1(config)#ip route 192.168.2.0 255.255.255.0 172.16.1.2
i1(config)#end

i2(config)#ip route 192.168.1.0 255.255.255.0 172.16.1.1
i2(config)#end
i2#
*Aug 17 19:16:15: %SYS-5-CONFIG_I: Configured from console by console
i2#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/12/28 ms
i2#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/9/12 ms

a static route for the hosts uses the tunnel to transit...

host1>ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
host1>

i1#sh ip route | excl L | incl Loop
omitted     

Gateway of last resort is not set

      1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        1.1.1.0/24 is directly connected, FastEthernet0/1
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.1.0/24 is directly connected, Tunnel0
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, FastEthernet0/0
S     192.168.2.0/24 [1/0] via 172.16.1.2

we love wireshark...