GRE over IPsec

[eha2476]

Hi

we have a Branch office and we want to connect it to our Core Router R1 or R2 with GRE over IPsec. The Routing Protocol is BGP.

My quesition is

Can i connect the new Location directly with our R1 or R2 Router or this can cause a Security Problem?

or

Should I connect the Branch Office ( new Location ) to a Firewall then from our Firewall to R1

If you have other suggestions that would be appreciated

[Rob Ingram]

@eha2476 

It is quite common to have a router to router VPN, there isn't necessarily a need to terminate the VPN on a firewall. As far as security is concerned, use the strongest algorithms such as AES, SHA2, DH Group 14, 19, 20 or 21, if possible use certificate or use a complex pre-shared key for authentication.