P2P GRE over IPsec
R1 (config) # interface tunnel 1
R1 (config-if) # ip address 1.1.1.1 255.255.255.0
R1 (config-if) # tunnel source 12.1.1.1
R1 (config-if) # tunnel destination 23.1.1.3
R1 (config-if) # exit
R3 (config) # int tunnel 3
R3 (config-if) # ip address 1.1.1.3 255.255.255.0
R3 (config-if) # tunnel source 23.1.1.3
R3 (config-if) # tunnel destination 12.1.1.1
R3 (config-if) # exit
R1 (config) # crypto isakmp policy 1
R1 (config-isakmp) # encryption 3des
R1 (config-isakmp) # hash sha
R1 (config-isakmp) # authentication pre-share
R1 (config-isakmp) # group 2
R1 (config-isakmp) # exit
R1 (config) # crypto isakmp key 0 cisco123 address 23.1.1.3
R1 (config) # crypto ipsec transform-set ccie esp-3des esp-sha-hmac
R1 (cfg-crypto-trans) # exit
R1 (config) # access-list 100 permit gre host 12.1.1.1 host 23.1.1.3 R1 (config) # crypto map L21 1 ipsec-isakmp
R1 (config-crypto-map) # set peer 23.1.1.3
R1 (config-crypto-map) # set transform-set ccie
R1 (config-crypto-map) # match address 100R1 (config-crypto-map) # exit
R1 (config) # int f0bin0R1 (config-if) # crypto map L2l
R1 (config-if) # exit
R1 (config) #
* Mar 1 0021 Mar 45.171:% CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R1 (config) #
R3 (config) # crypto isakmp policy 1
R3 (config-isakmp) # encryption 3des
R3 (config-isakmp) # hash sha
R3 (config-isakmp) # authentication pre-share
R3 (config-isakmp) # group 2
R3 (config-isakmp) # exit
R3 (config) # crypto isakmp key 0 cisco123 address 12.1.1.1
R3 (config) # crypto ipsec transform-set ccie esp-3des esp-sha-hmac
R3 (cfg-crypto-trans) # exit
R3 (config) # access-list 100 permit gre host 23.1.1.3 host 12.1.1.1 R3 (config) #
R3 (config) # crypto map L2l 1 ipsec-isakmp
R3 (config-crypto-map) # set peer 12.1.1.1
R3 (config-crypto-map) # set transform-set ccie
R3 (config-crypto-map) # match address 100
R3 (config-crypto-map) # exit
R3 (config) #
R3 (config) # int f0swap 1
R3 (config-if) # crypto map L2l
R3 (config-if) #
* Mar 1 00 ISAKMP is ON 32 ISAKMP is ON 58. 907:% CRYPTO-6-ISAKMP_ON_OFF:
R3 (config-if) #
R1 (config) # router eigrp 1
R1 (config-router) # no auto-summary
R1 (config-router) # network 1.1.1.1 0.0.0.0
R1 (config-router) # network 10.1.1.1 0.0.0.0
R1 (config-router) # exit
R3 (config) # router eigrp 1
R3 (config-router) # no auto-summary
R3 (config-router) # network 1.1.1.3 0.0.0.0
R3 (config-router) # network 192.168.1.3 0.0.0.0
R3 (config-router) #
Description: the default mode of IPsec is Tunnel mode, which should not be in doubt.
(1) change the IPsec Mode of R3 to transport mode:
R3 (config) # crypto ipsec transform-set ccie esp-3des esp-sha-hmac
R3 (cfg-crypto-trans) # mode transport
Clear SA of both parties:
R3#clear crypto sa
R3#
Note: after changing the mode, clear the SA of both sides to reconnect
Although the IPsec Mode of R3 has been changed to transport mode, but still working in Tunnel mode, because the other side has not changed, only when both sides change, the final working mode will be changed.
Note: after changing the IPsec Mode of both sides to transport mode, the two sides finally work in transport mode, which also needs to be strongly explained and reminded here. Only in the case of P2P GRE over IPsec, the working mode of IPsec Mode can be transport mode, otherwise, even if the mode of both sides is forcibly changed to transport mode, eventually both parties will still work in Tunnel mode.
