how to configure gre tunnel on cisco ios router
DESCRIPTION
GRETRANSCRIPT
How to configure GRE Tunnel on Cisco IOS Router
Posted on April 10, 2013 by Rene Molenaar in CCNP R&S, Cisco
Tunneling is a concept where we put ‘packets into packets’ so that they can be transported over certain networks. We also call this encapsulation.A good example is when you have two sites with IPv6 addresses on their LAN but they are only connected to the Internet with IPv4 addresses.Normally it would be impossible for the two IPv6 LANs to reach each other but by using tunneling the two routers will put IPv6 packets into IPv4 packets so that our IPv6 traffic can be routed on the Internet.
Another example is where we have an HQ and a branch site and you want to run a routing protocol like RIP, OSPF or EIGRP between them. We can tunnel these routing protocols so that the HQ and branch router can exchange routing information.
Basically when you configure a tunnel, it’s like you create a point-to-point connectionbetween the two devices. GRE (Generic Routing
Encapsulation) is a simple tunneling technique that can do this for us. Let me show you a topology that we will use to demonstrate GRE:
Above we have 3 routers connected to each other. On the left side we have the “HQ” router which is our headquarters. On the right side there is a “Branch” router that is supposed to be a branch office. Both routers are connected to the Internet, in the middle on top there is an ISP router. We can use this topology to simulate two routers that are connected to the Internet. The HQ and Branch router each have a loopback interface that represents the LAN.
Let me show you the basic configuration of these routers so that you can recreate it if you want:
HQ(config)#interface fastEthernet 0/0 HQ(config-if)#ip address 192.168.12.1 255.255.255.0HQ(config-if)#exitHQ(config)#interface loopback0HQ(config-if)#ip address 172.16.1.1 255.255.255.0HQ(config-if)#exitHQ(config)#ip route 192.168.23.3 255.255.255.255 192.168.12.2
ISP(config)#interface fastEthernet 0/0ISP(config-if)#ip address 192.168.12.2 255.255.255.0ISP(config-if)#exitISP(config)#interface fastEthernet 1/0ISP(config-if)#ip address 192.168.23.2 255.255.255.0Branch(config)#interface fastEthernet 0/0Branch(config-if)#ip address 192.168.23.3 255.255.255.0Branch(config-if)#exitBranch(config)#interface loopback 0Branch(config-if)#ip address 172.16.3.3 255.255.255.0Branch(config-if)#exitBranch(config)#ip route 192.168.12.1 255.255.255.255 192.168.23.2
I created a static route on the HQ and Branch router so that they can reach each other through the ISP router. They will be unable to reach the networks on each others loopback interfaces however. Now let’s create a tunnel:
HQ(config)#interface tunnel 1 HQ(config-if)#tunnel source fastEthernet 0/0HQ(config-if)#tunnel destination 192.168.23.3HQ(config-if)#ip address 192.168.13.1 255.255.255.0Branch(config)#interface tunnel 1Branch(config-if)#tunnel source fastEthernet 0/0Branch(config-if)#tunnel destination 192.168.12.1Branch(config-if)#ip address 192.168.13.3 255.255.255.0
You can pick any number for the tunnel interface that you like. We need to specify a source and destination IP address to build the tunnel and we’ll use the 192.168.13.0 /24 subnet on the tunnel interface. Let’s verify that our tunnel is working:
HQ#show interfaces tunnel 1Tunnel1 is up, line protocol is up Hardware is Tunnel Internet address is 192.168.13.1/24 MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL, loopback not set Keepalive not set Tunnel source 192.168.12.1 (FastEthernet0/0), destination 192.168.23.3 Tunnel protocol/transport GRE/IPBranch#show interfaces tunnel 1Tunnel1 is up, line protocol is up Hardware is Tunnel Internet address is 192.168.13.3/24 MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL, loopback not set Keepalive not set Tunnel source 192.168.23.3 (FastEthernet0/0), destination 192.168.12.1 Tunnel protocol/transport GRE/IP
Above you can see that the tunnel interface is up/up on both routers. The default tunneling mode is GRE. Let’s see if both routers can reach each other:
Branch#ping 192.168.13.1
Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.13.1, timeout is 2 seconds:!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/12 ms
There we go…they can ping each other without any issues! So that wasn’t too bad right? Let’s see if we can enable a routing protocol so that we can advertise the loopback interfaces. I’ll use EIGRP for this:
HQ(config)#router eigrp 13 HQ(config-router)#no auto-summary HQ(config-router)#network 192.168.13.0HQ(config-router)#network 172.16.1.0Branch(config)#router eigrp 13Branch(config-router)#no auto-summary Branch(config-router)#network 192.168.13.0Branch(config-router)#network 172.16.3.0
I’ll activate EIGRP on the tunnel and loopback interfaces. You will see that both routers establish an EIGRP neighbor adjacency through the tunnel interface. Let’s check the routing tables:
HQ#show ip route eigrp 172.16.0.0/24 is subnetted, 2 subnetsD 172.16.3.0 [90/297372416] via 192.168.13.3, 00:01:31, Tunnel1Branch#show ip route eigrp 172.16.0.0/24 is subnetted, 2 subnetsD 172.16.1.0 [90/297372416] via 192.168.13.1, 00:01:51, Tunnel1
As you can see the two routers learned about each others networks. They will use the tunnel interface to reach each other. Let’s do a quick test:
HQ#ping 172.16.3.3 source loopback 0
Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 172.16.3.3, timeout is 2 seconds:Packet sent with a source address of 172.16.1.1 !!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 4/8/12 ms
A quick ping between the loopback interfaces proves that the two “LANs” can reach each other.
Be careful when you run a routing protocol on the tunnel interface as this can causerecursive routing issues. If you don’t know what this is, take a look at my recursive routing GRE tunnel article.
In case you are curious, let me show you what encapsulated packets look like in wireshark:
Take a close look at the source and destination IP addresses. You can see the packet between 192.168.12.1 and 192.168.23.3 and inside you will find the IP packet between 172.16.1.1 and 172.16.3.3.
Note that GRE does tunneling for us but doesn’t encrypt any traffic like a VPN does. IPSEC is one of the protocols that can encrypt the packets within our tunnel.