PIX to IOS Router with GRE?!

[andy.priest]

I have a main site with a Cisco 3640 behind a Cisco Pix 515 Firewall. At my branch site I have a Cisco 1720. Has anyone else any experience/configs for setting up a GRE tunnel from the Cisco 3640 to the Cisco 1720 and encrypting it using the Main site PIX and the Branch site 1720. We currently do a lot IPSEC/GRE IOS - IOS, but do not have much experience doing this though a PIX. After having a go at the config a few months ago and kind of getting it working, for about 1 day, I have not had much more time to do this, or investigate if it is secure.

[rbharania]

I've seen customers do this with a fair amount

of regularity, it's pretty straight forward to

set this up, and the PIX and IOS should have

no problems talking to one another with IPSEC

(this sounded like it may have been a concern of

yours) - at any rate, as to whether it's "secure" -

depends on your policy. An obvious place for

attacks on the GRE tunnel are prior (or after)

the crypto endpoints - so check your other internal security.

The other thing that you might want to do to educate yourself about IPSEC is read the evauluation on

the Counterpane Systems homepage (www.counterpane.com) - it points out some of the

flaws of IPSEC (but also states that for what it does, there isn't anything better).

-Rakesh