Cisco Systems 520 series manual Configure a VPN, GRE Tunnels, VPNs

Chapter 7 Configuring VPNs Using an IPsec Tunnel and Generic Routing Encapsulation

Configure a VPN

GRE Tunnels

GRE tunnels are typically used to establish a VPN between the Cisco router and a remote device that controls access to a private network, such as a corporate network. Traffic forwarded through the GRE tunnel is encapsulated and routed out onto the physical interface of the router. When a GRE interface is used, the Cisco router and the router that controls access to the corporate network can support dynamic IP routing protocols to exchange routing updates over the tunnel, and to enable IP multicast traffic.

Supported IP routing protocols include Routing Information Protocol (RIP) and Intermediate System-to-Intermediate System (IS-IS).

Note When IP Security (IPsec) is used with GRE, the access list for encrypting traffic does not list the desired end network and applications, but instead refers to the permitted source and destination of the GRE tunnel in the outbound direction. All packets forwarded to the GRE tunnel are encrypted if no further access control lists (ACLs) are applied to the tunnel interface.

VPNs

VPN configuration information must be configured on both endpoints; for example, on your Cisco router and at the remote user, or on your Cisco router and on another router. You must specify parameters, such as internal IP addresses, internal subnet masks, DHCP server addresses, and Network Address Translation (NAT).

Configuration Tasks

Perform the following tasks to configure this network scenario:

•Configure a VPN

•Configure a GRE Tunnel

A configuration example showing the results of these configuration tasks is provided in the “Configuration Example” section on page 7-9.

Note The procedures in this chapter assume that you have already configured basic router features as well as PPPoE or PPPoA with NAT, DCHP, and VLANs. If you have not performed these configurations tasks, see Chapter 1, “Basic Router Configuration,” Chapter 3, “Configuring PPP over Ethernet with NAT,” Chapter 4, “Configuring PPP over ATM with NAT,” and Chapter 5, “Configuring a LAN with DHCP and VLANs,” as appropriate for your router.

Configure a VPN

Perform the following tasks to configure a VPN over an IPsec tunnel:

•Configure the IKE Policy

•Configure Group Policy Information

•Enable Policy Lookup

•Configure IPsec Transforms and Protocols

•Configure the IPsec Crypto Method and Parameters

•Apply the Crypto Map to the Physical Interface

Cisco Secure Router 520 Series Software Configuration Guide

7-2 OL-14210-01