cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1026
Views
0
Helpful
1
Replies
Highlighted
Beginner

Gdoi and the when to use it

I just upgraded several of my small sites that I do GRE tunnels to from a host router.   When I am configuring these GRE tunnels the statement only GDOI crypto map is supported on tunnel interface.   Should I be switching all of my GRE tunnels to GDOI, what is this type of configuration used for?                       

1 REPLY 1
Highlighted
Hall of Fame Cisco Employee

Hi Tracy,

You should not configure a crypto map on the Tunnel interface. If you want to use IPsec-protected GRE tunnels, you should either configure the crypto map on the non-Tunnel interface towards the ISP, or create a crypto profile and use it on the Tunnel interface using the tunnel protection ipsec command. Once again, however, do not configure any crypto map on the Tunnel interface directly.

The GDOI is a relatively new concept of deploying IPsec VPNs over a MPLS or similar VPN where the basic VPN connectivity and isolation is already provided by the service provider and you want to use additional confidentiality, authentication and integrity protection over this existing VPN. Without going into too much detail, I believe that you do not need GDOI right now - you'd know about it otherwise

Best regards,

Peter

Content for Community-Ad