topic GETVPN question in VPN

GETVPN question

zoran.suica — Sat, 22 Feb 2020 01:49:00 GMT

Hello,

I have a couple of routers that are members of the same GETVPN group

and share the same network on which traffic is encrypted (same WAN network).

My access list from key server permits encryption for everything except eigrp

and ssh.

If I ping one router (his WAN interface) from other router (also his WAN interface,

same subnet) will this ping be encrypted?

List from key server would say yes but I don't know if this goes also for router originating

traffic (from interface on which I have crypto map).

Thanks,

Zoran

GETVPN question

Marcin Latosiewicz — Sat, 14 Jan 2012 08:00:03 GMT

Zoran,

Yes, router originated traffic is also subject to encryption (we only put a silent deny for UDP/848).

In theory almost everything hits crypto on the way out :-)

Have you seen those packets leaking out in clear? A very easy way to see is "debug ip packet" (with ACLs) packets originated from the box will show in debugs by default.

GETVPN question

zoran.suica — Sun, 15 Jan 2012 23:33:17 GMT

Marcin,

thank you very much for your answer. I've done "debug ip packet" and they are

encrypted so everything is like you said but I wanted to double check, especially

because I've heard from some colleagues that it should not be encrypted.

Cheers,

Zoran

GETVPN question

Marcin Latosiewicz — Mon, 16 Jan 2012 10:03:24 GMT

Zoran,

Consider we need to add explicity deny for routing protocols (not only multicast based, but also unicast) in GETVPN encryption ACL - all routing protocols are considered originating from the box (the ones with "router ...." statment on the box).

Marcin