topic Re: P-P GRE Link in Network Security

P-P GRE Link

cgravell — Fri, 21 Feb 2020 10:58:01 GMT

Hi,

I wish to route a public IP range from one provider across another providers backbone. I want to route this range statically via a GRE tunnel.

However, the end-point (Customer spoke) is only DYNAMICALLY IP assigned a PUBLIC address.

Is it possible to create a tunnel between the two sites, where one is dynamic, the other static and where I can route an IP range through this tunnel if the spoke IP end-point is unknown?

Thanks!

Re: P-P GRE Link

Farrukh Haroon — Thu, 14 Aug 2008 12:40:57 GMT

Have you looked at DMVPN (One Hub and One Spoke)?

DMVPN uses NHRP to form spokes on the fly. The HUB does not need to know the public IP of the spokes at configuration time. The Tunnel/Public IP of the hub are hard coded in the spoke(s). Once it comes up the spoke registers itself to the hub dynamically (using the NHRP protocol).

Regards

Farrukh

Re: P-P GRE Link

dhananjoy chowdhury — Sat, 16 Aug 2008 19:22:37 GMT

Hi,

You can use the DMVPN feature.

Use the Router with Fixed IP as the DMVPN Hub and the Router with dynamic IP as the spoke.

DMVPN is based on GRE, However I would suggest to encrypt the GRE traffic using IPSEC, but this is not necessary.

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008014bcd7.shtml#conf

Once the DMVPN tunnel is setup, you can route your IP subnets via this tunnel interface.

Re: P-P GRE Link

cgravell — Sun, 17 Aug 2008 05:41:47 GMT

Hi guys,

Thanks for the responses. I have used DMVPN since it was bleeding nose tech 4 or 5 years ago. I don't need to encrypt. The interface in this case is only p-p so I don't require a multi-point GRE interface (I remove that from the config). I guess my question is therefore, are there any other encap technologies that allow me to efficiently encap IP in IP without encryption to route a public IP range from one provider over another providers network? The caveat being that the spoke is dynamically assigned.

Anyone familiar with getVPN? Does this do this? Or is this pure crypto technology?