topic Re: GRE alternatives for PIX in Network Security

GRE alternatives for PIX

tato386 — Fri, 21 Feb 2020 06:16:26 GMT

I need to design a VPN network around a PIX 515E hub site and IOS routers at the remote sites. In the past, I have designed VPN networks using only IOS routers. I like to use IPSec encrypted GRE tunnels so that I can run RIP over the VPN and also so that I can create default routes for Internet traffic via the GRE tunnel interfaces to route traffic thru centralized URL monitoring and filtering devices. I was told that the PIX does not support GRE. How can I do the above without GRE? What are my alternatives?

Thanks,

Diego

Re: GRE alternatives for PIX

jekrauss — Thu, 26 Sep 2002 23:38:24 GMT

Diego,

The pix just doesn't support termination of GRE tunnels. However, you can terminate your GRE tunnels on a router inside of your pix.

ie. router-------pix---------Internet-------------router

gre---------------------------------------------gre (from router to router)

----------------> ipsec-----------------------------ipsec (from pix to router)

The ipsec tunnel on the pix uses the gre traffic as the interesting traffic.

Here's a doc that shows you how to do it:

http://www.cisco.com/warp/public/707/gre_ipsec_ospf.html#diagram

HTH

Jeff

Re: GRE alternatives for PIX

tato386 — Fri, 27 Sep 2002 13:34:43 GMT

Looks like that might work.

Thanks!

Diego

Re: GRE alternatives for PIX

tato386 — Tue, 08 Oct 2002 19:36:21 GMT

Jeff:

After looking at that article more closely I see something that might be a problem. The GRE tunnel is being created over the Internet. However, each router references the other router's internal interface with its private IP. Obviously this would not work. The GRE endpoints would have to reference public IPs. This in turn means that the PIXes would have to do some NAT. So the question becomes can the PIX correctly encrypt packets that are being sent to a NATed address. At best, this would complicate the PIX config quite a bit. What about having the internal router with one interface on the DMZ and one on the private network. Wouldn't that be easier?

Thanks,

Diego