topic Re: ipsec(tunnelmode)+gre+eigr in Network Security

ipsec(tunnelmode)+gre+eigr

adaubenton — Fri, 21 Feb 2020 07:52:06 GMT

is it possible to use ipsec(tunnelmode)+gre+eigrp at the sime time?

Re: ipsec(tunnelmode)+gre+eigr

Richard Burts — Fri, 14 Jan 2005 15:08:21 GMT

It is possible. In a customer network we are doing IPSec over GRE and running EIGRP. I have configured IPSec for both tunnel mode and for transport mode. Both of them worked.

HTH

Rick

Re: ipsec(tunnelmode)+gre+eigr

adaubenton — Fri, 14 Jan 2005 15:49:32 GMT

thank you, in fact my configuration work well only for 5 minutes.

my next step: CBWFQ+GTS

Bye

Arnaud

Re: ipsec(tunnelmode)+gre+eigr

rhaeppeler — Fri, 21 Jan 2005 12:28:40 GMT

Hi,

we have about 50 Companies in the whole world connected via GRE over IPSec. A lot of the companies are meshed. So EIGRP can find the best way to the HQ in DE if we have Problems with the ISP. Additional we can use floating static routes to enable ISDN-Backup when Internet is down. It works fine.

Regards Rainer

Re: ipsec(tunnelmode)+gre+eigr

lemair_a — Mon, 31 Jan 2005 17:14:54 GMT

Hi,

do you have any problem with splithorizon ?

On the central site, if you are connected via multi gre tunnels to other sites, using only one physical interface on the central site ?

regards Arno

Re: ipsec(tunnelmode)+gre+eigr

Richard Burts — Mon, 31 Jan 2005 19:13:15 GMT

The real question is not whether you are connected using a single physical interface at the central site. I have a customer who is currently using a single physical interface for about 90 GRE tunnels with no issue about split horizon. But these are traditional point to point GRE tunnels. If you connect to multiple remote locations with a multipoint GRE tunnel then there is an issue with EIGRP split horizon and you would need to turn off split horizon. If you do not disable split horizon the symptom is likely to be that all remotes can talk to the central site, the central site can talk to all remotes, but one remote will not be able to talk to other remotes.

HTH

Rick

Re: ipsec(tunnelmode)+gre+eigr

rhaeppeler — Tue, 01 Feb 2005 06:27:51 GMT

Hello Arno,

No, we don't have a Problem with splithorizion because we have for each Company a own GRE-Tunnel (point-to-point) for the Routing-Protocol it's like a own Interface for each Branch. We don't use Multipoint GRE

Re: ipsec(tunnelmode)+gre+eigr

lemair_a — Tue, 01 Feb 2005 12:08:04 GMT

Thank you for your answers Rainer and Rick, that was the point i wasn't sure about.

Arno