topic EIGRP over IPSEC in Network Security

EIGRP over IPSEC

abbas.ali — Fri, 21 Feb 2020 06:23:18 GMT

Is it true that in order to run EIGRP between site-to-site VPN, One must need to run GRE because what I read that IPSEC doesn't support multiprotocol?

But then, my headqurter has PIX Firewall, where I was thinking of terminating 8 IPSEC tunnels from the remote offices. What I read that PIX Firewall and VPN Concentrators don't support GRE. Is there any alternatives.

Re: EIGRP over IPSEC

Nairi Adamian — Tue, 19 Nov 2002 23:57:03 GMT

You can terminate the ipsec tunnel on the pix but you still need to have a router behind the pix to terminate the GRE tunnel.

something similar to the sample configuration below:

http://www.cisco.com/warp/public/707/gre_ipsec_ospf.html

hope this helps,

-Nairi

Re: EIGRP over IPSEC

lnthompson — Tue, 14 Jan 2003 19:11:53 GMT

We build the GRE to the MSFC's on the 6500 inside the firewall. It works quite well as the previous post mentioned.

Re: EIGRP over IPSEC

Neil Anderson — Mon, 20 Jan 2003 23:37:28 GMT

GRE is needed as IPSec does not support multicast needed for dynamic routing protocols such as EIGRP.

Depending on your remotes and routing plan, Reverse Route Injection (RRI)may be an option if you don't need to run "full" dynamic routing on both endpoints. RRI is available on IOS VPN Routers and VPN3000 Concentrator.

Also, PIX Firewall is OK as a site-to-site VPN head-end, however IOS VPN Router at head-end more readily supports hub-and-spoke/site-to-site VPN topologies, especially when spoke-to-spoke traffic is required.