ISCW10S04L04Gre over IPsec【荐】.ppt

IPsec VPNs Configuring GRE Tunnels over IPsec Generic Routing Encapsulation OSI Layer 3 tunneling protocol: Uses IP for transport Uses an additional header to support any other OSI Layer 3 protocol as payload (e.g., IP, IPX, AppleTalk) Default GRE Characteristics Tunneling of arbitrary OSI Layer 3 payload is the primary goal of GRE Stateless (no flow control mechanisms) No security (no confidentiality, data authentication, or integrity assurance) 24-byte overhead by default (20-byte IP header and 4-byte GRE header) Optional GRE Extensions GRE can optionally contain any one or more of these fields: Tunnel checksum Tunnel key Tunnel packet sequence number GRE keepalives can be used to track tunnel path status. GRE Configuration Example GRE tunnel is up and protocol up if: Tunnel source and destination are configured Tunnel destination is in routing table GRE keepalives are received (if used) GRE is the default tunnel mode. Introducing Secure GRE Tunnels GRE is good at tunneling: Multiprotocol support Provides virtual point-to-point connectivity, allowing routing protocols to be used GRE is poor at security—only very basic plaintext authentication can be implemented using the tunnel key (not very secure) GRE cannot accommodate typical security requirements: Confidentiality Data source authentication Data integrity IPsec Characteristics IPsec provides what GRE lacks: Confidentiality through encryption using symmetric algorithms (e.g., 3DES or AES) Data source authentication using HMACs (e.g., MD5 or SHA-1) Data integrity verification using HMACs IPsec is not perfect at tunneling: Older Cisco IOS software versions do not support IP multicast over IPsec IPsec was designed to tunnel IP only (no multiprotocol support) Using crypto maps to implement IPsec does not allow the usage of routing protocols across the tunnel IPsec does not tunnel IP protocols; GRE does GRE over IPsec GRE over IPsec is typically used to do the following: Create a logical hub-and-spoke topology of v