Re: GRE over IPSec?

[Les Mikesell <les@futuresource.com>]

On Thu, 2005-01-06 at 11:53, primero@hdr-roma.it wrote:

> >This may be off-topic for this list but perhaps someone could at least
> >point me to a better source...  When doing IPSec tunnels between Cisco
> >routers it works nicely to first make a GRE tunnel which gives you
> >a fairly normal interface that can run routing protocols, etc., then
> >use 'crypto map' to push the GRE packets through IPSec encryption.
> >
> >Are there any examples available that would match this setup with
> >Linux on one end, Cisco on the other?  A Linux<->Cisco GRE is easy
> >enough and zebra/quagga should run rip or ospf over that, but then
> >I'd like to pass the GRE packets though IPSec before sending.
> >
> >  
> >
> would not be better to have a GRE Tunnel Secured with ipsec?
> i mean creating the normale tunnel
> 
> interface tunnel 1
> etc ....
> 
> then apply the crypto map to make a transport ipsec point 2 point 
> connecttion beetween the REAL interface ip address of both end of the 
> tunnel matching GRE packets.
> 
> This way you'll have a logical interface Tunnel on both routers with an 
> IPSEC encryption for all GRE packets beetween this 2 interfaces.

I thought that was what I said... Regardless, what I want is the
Linux-side setup to match.  On the Ciscos, the GRE is configured
to work without IPSec, then the IPSec tunnel is established and
an access list blocks unencrypted GRE packets. 

-- 
  Les Mikesell
    les@futuresource.com