Lab VPN: Tunel GRE sobre IPSec

Um dos grandes problemas do Framework IPSec é sua incapacidade em lidar com tráfego não unicast por exemplo tráfego multicast (muito útil para protocolos de transmissão de vídeo e protocolos de roteamento). Por outro lado também não pode encapsular protocolos de roteamento como RIP, OSPF, EIGRP. O GRE por outro lado pode fazer isto. Suporta tráfego multicast e encapsula protocolos de roteamento. So que nao suporta encriptacao de trafego, coisa qe IPSec suporta.

Para solucionar isto o segredo passa por criar um tunelamento GRE sobre IPSec. No nosso exemplo abaixo o tráfego tunelado passa pela subrede 172.18.3.0/24 configurados nos roteadores LUANDA E MALANJE (CAPANDA). O túnel IPSec foi criado nas interfaces publicas 193.0.0.10 (LUANDA) e 193.0.0.6 MALANJE (CAPANDA). O protocolo de roteamento é o EIGRP.

Configuracoes:

PROVEDOR INTERNET – CLOUD

PROVEDOR(CLOUD)#sh run
Building configuration...

Current configuration : 690 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname PROVEDOR(CLOUD)
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
shutdown
!
interface FastEthernet0/1
ip address 193.0.0.9 255.255.255.248
duplex auto
speed auto
!
interface Serial0/0/0
ip address 193.0.0.5 255.255.255.252
clock rate 64000
!
interface Serial0/0/1
no ip address
shutdown
!
interface Vlan1
no ip address
shutdown
!
router eigrp 10
network 193.0.0.4 0.0.0.3
network 193.0.0.8 0.0.0.7
no auto-summary
!
ip classless
!
!
!
!
line con 0
line vty 0 4
login
!
!
!
end

LUANDA

LUANDA#sh run
Building configuration...

Current configuration : 1373 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname LUANDA
!
!
crypto isakmp policy 100
encr aes 256
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp key ciscoK3y address 193.0.0.6
!
!
crypto ipsec transform-set strong esp-aes 256 esp-sha-hmac
!
crypto map vpn 10 ipsec-isakmp
set peer 193.0.0.6
set pfs group2
set transform-set strong
match address 101
!
!
!
!
interface Tunnel0
ip address 172.18.3.1 255.255.255.0
tunnel source FastEthernet0/1
tunnel destination 193.0.0.6
!
!
interface FastEthernet0/0
ip address 172.18.1.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 193.0.0.10 255.255.255.248
ip access-group 101 out
duplex auto
speed auto
crypto map vpn
!
interface Serial0/0/0
no ip address
shutdown
!
interface Serial0/0/1
no ip address
shutdown
!
interface Vlan1
no ip address
shutdown
!
router eigrp 10
network 193.0.0.8 0.0.0.7
no auto-summary
!
router eigrp 20
network 172.18.1.0 0.0.0.255
network 172.18.3.0 0.0.0.255
no auto-summary
!
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet0/1
!
!
access-list 101 permit gre host 193.0.0.10 host 193.0.0.6
access-list 101 permit ip 172.18.1.0 0.0.0.255 172.18.2.0 0.0.0.255
!
!
!
line con 0
line vty 0 4
login
!
!
!
end

MALANJE (CAPANDA)

MALANJE(CAPANDA)#sh run
Building configuration...

Current configuration : 1377 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname MALANJE(CAPANDA)
!
!
!
crypto isakmp policy 100
encr aes 256
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp key ciscoK3y address 193.0.0.10
!
!
crypto ipsec transform-set strong esp-aes 256 esp-sha-hmac
!
crypto map vpn 10 ipsec-isakmp
set peer 193.0.0.10
set pfs group2
set transform-set strong
match address 101
!
!
!
interface Tunnel0
ip address 172.18.3.2 255.255.255.0
tunnel source Serial0/0/0
tunnel destination 193.0.0.10
!
!
interface FastEthernet0/0
ip address 172.18.2.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/0/0
ip address 193.0.0.6 255.255.255.252
ip access-group 101 out
crypto map vpn
!
interface Serial0/0/1
no ip address
shutdown
!
interface Vlan1
no ip address
shutdown
!
router eigrp 10
network 193.0.0.4 0.0.0.3
no auto-summary
!
router eigrp 20
network 172.18.2.0 0.0.0.255
network 172.18.3.0 0.0.0.255
no auto-summary
!
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0/0
!
!
access-list 101 permit ip 172.18.2.0 0.0.0.255 172.18.1.0 0.0.0.255
access-list 101 permit gre host 193.0.0.6 host 193.0.0.10
!
!
!
line con 0
line vty 0 4
login
!
!
!
end