Cisco Configuring GRE over IPsec User Manual PDF

Overview of VRF aware GRE over IPsec

Configuring GRE over IPsec Restrictions for GRE over IPsec, on page 1 Information about GRE Over IPsec, on page 1 How to Configure GRE over IPsec, on page 2 Configuration Examples for GRE over IPsec, on page 10 Feature History for GRE over IPsec, on page 12 Restrictions for GRE over IPsec • GRE over IPsec doesn't support Multipoint GRE (mGRE). • GRE over IPSec doesn't support multiple sessions from the same tunnel source to the same tunnel destination. • GRE over IPsec doesn't support concurrent Static Virtual Tunnel Interface (SVTI) and GRE over IPsec tunnel with the same tunnel source and tunnel destination. • Keepalive is not supported on VRF aware GRE over IPsec tunnels.

Information about GRE Over IPsec You can configure Generic Routing Encapsulation (GRE) over an Internet Protocol Security (IPsec) tunnel on Cisco IOS XE devices. GRE can encapsulate several types of traffic such as unicast, multicast, broadcast, and MPLS. However, GRE doesn't provide any type of protection for the transmitted payload. Internet Protocol Security (IPsec) provides confidentiality, integrity, and authentication to the payloads transmitted through IPsec tunnels. However, IPsec can function only with IP packets. The GRE over IPsec feature allows for the flexibility of using GRE along with the security of IPsec. GRE encapsulates the packets.

IPsec encrypts the packets and transports them through an IPsec tunnel. Overview of VRF aware GRE over IPsec A VRF instance is a per-VPN routing information repository that defines the VPN membership of a customer site attached to the Provider Edge (PE) router. A VRF comprises an IP routing table, a derived Cisco Express Forwarding (CEF) table, a set of interfaces that use the forwarding table, and a set of rules and routing protocol Configuring GRE over IPsec 1

Page 1

Configuring the IKEv2 Keyring

parameters that control the information that is included in the routing table. A separate set of routing and CEF tables is maintained for each VPN customer. Starting with the 17.13.1 release, VRF support has been introduced for GRE over IPsec tunnels. Each GRE over IPsec tunnel is associated with two VRF domains. The outer encapsulated packet belongs to one VRF domain, which is called Front Door VRF (FVRF), while the inner, protected IP packet belongs to another domain called the Inside VRF (IVRF). The local endpoint of the IPsec tunnel belongs to the FVRF while the source and destination addresses of the inside packet belong to the IVRF.

In a VRF aware GRE over IPsec instance, when a packet starts from the service provider network it gets encapsulated based on the security policy. The encapsulated packet is forwarded using the FVRF routing table. When the packet arrives at the PE endpoint the security associations are validated. Then the packet is decapsulated and associated with an IVRF. The packet is forwarded using the IVRF routing table. One or more IPsec tunnels can terminate on a single interface. The FVRF of all these tunnels is the same and is set to the VRF that is configured on that interface.

The IVRF of these tunnels can be different and depends on the VRF that is defined in the Internet Security Association and Key Management Protocol (ISAKMP) profile that is attached to a crypto map entry. How to Configure GRE over IPsec The following sections explain the procedures that you can perform to configure a GRE over IPsec tunnel interface. Configuring the IKEv2 Keyring Perform this task to configure the IKEv2 keyring if the local or remote authentication method is a preshared key. Configure the IKEv2 keyring keys in the peer configuration submode that defines a peer subblock. An IKEv2 keyring can have multiple peer subblocks.

A peer subblock contains a single symmetric or asymmetric key pair for a peer or peer group. Any combination of the hostname, identity, and IP address identifies the peer or the peer group. IKEv2 keyrings are independent of IKEv1 keyrings. The key differences are as follows: • IKEv2 keyrings support symmetric and asymmetric preshared keys. • IKEv2 keyrings don't support Rivest, Shamir, and Adleman (RSA) public keys. • IKEv2 keyrings are specified in the IKEv2 profile and aren’t looked up, unlike IKEv1 keys. IKEv1 keys are looked up on receipt of MM1 to negotiate the preshared key authentication method. IKEv2 doesn't negotiate the authentication method.

• IKEv2 keyrings aren't associated with VPN routing and forwarding (VRF) during configuration. The VRF of an IKEv2 keyring is the VRF of the IKEv2 profile that refers to the keyring. • You can specify a single keyring in an IKEv2 profile, unlike an IKEv1 profile, which can specify multiple keyrings. • If peers matching different profiles share the same keys, you can specify a single keyring in more than one IKEv2 profile, . • An IKEv2 keyring is structured as one or more peer subblocks. Configuring GRE over IPsec How to Configure GRE over IPsec Configuring GRE over IPsec 2

Page 2

Configuring the IKEv2 Keyring

On an IKEv2 initiator, the IKEv2 keyring key lookup is performed using the hostname or the address of the peer, in that order. On an IKEv2 responder, the key lookup is performed using the IKEv2 identity or the address of the peer, in that order. You can't configure the same identity in more than one peer. Note Procedure Configuring GRE over IPsec Configuring the IKEv2 Keyring Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. Enter your password, if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 crypto ikev2 keyring keyring-name Example:

Device(config)# crypto ikev2 keyring kyr1 Defines an IKEv2 keyring. Enters IKEv2 keyring configuration mode. Step 4 peer name Example: Device(config-ikev2-keyring)# peer peer1 Defines the peer or peer group. Enters IKEv2 keyring peer configuration mode. Step 5 description line-of-description Example: Device(config-ikev2-keyring-peer)# description this is the first peer (Optional) Describes the peer or peer group. Step 6 hostname name Example: Device(config-ikev2-keyring-peer)# hostname host1 Specifies the peer using a hostname. Step 7 address {ipv4-address [mask] | ipv6-address prefix} Example:

Device(config-ikev2-keyring-peer)# address 10.0.0.1 255.255.255.0 Specifies an IPv4 or IPv6 address or range for the peer. Note This IP address is the IKE endpoint address and is independent of the identity address. Step 8 identity {address {ipv4-address | ipv6-address} | fqdn domain domain-name | email domain domain-name | key-id key-id} Identifies the IKEv2 peer through the following identities: • E-mail Configuring GRE over IPsec 3

Page 3

Configuring an IKEv2 Profile (Basic)

Configuring an IKEv2 Profile (Basic) Perform this task to configure the mandatory commands for an IKEv2 profile. An IKEv2 profile is a repository of nonnegotiable parameters of the IKE security association (SA) (such as local or remote identities and authentication methods) and services available to authenticated peers that match the profile. An IKEv2 profile must be configured and associated with a crypto map. Use the set ikev2-profile profile-name command to associate a profile with a crypto map. To disassociate the profile, use the no form of the command. The following rules apply to match statements:

• An IKEv2 profile must contain a match identity or a match certificate statement; otherwise, the profile is considered incomplete and is not used. An IKEv2 profile can have more than one match identity or match certificate statements. • An IKEv2 profile must have a single match Front Door VPN routing and forwarding (FVRF) statement. • When a profile is selected, multiple match statements of the same type are logically ORed, and multiple match statements of different types are logically ANDed. Configuring GRE over IPsec Configuring an IKEv2 Profile (Basic) Command or Action Purpose Example:

Device(config-ikev2-keyring-peer)# identity address 10.0.0.5 • Fully qualified domain name (FQDN) Note When you use FQDN to identify the peer in the keyring configuration, use the IP address of the peer along with the FQDN crypto ikev2 keyring key1 peer headend-1 address 10.1.1.1 >>>>>>>>> identity fqdn NFVIS-headend-1.cisco.com pre-shared-key Cisco123 • IPv4 or IPv6 address • Key ID Note The identity is available for key lookup on the IKEv2 responder only. Step 9 pre-shared-key {local | remote} [0 | 6] line hex hexadecimal-string Example: Device(config-ikev2-keyring-peer)# pre-shared-key local key1 Specifies the preshared key for the peer. Step 10 end Example:

Device(config-ikev2-keyring-peer)# end Exits IKEv2 keyring peer configuration mode. Returns to privileged EXEC mode. Configuring GRE over IPsec 4

Page 4