PIX-to-Router - IPSec and GRE Tunnel on Same Interface?

mmandel · ‎01-17-2005

I have multiple vpns at my remote sites, they are all using GRE Tunnel to terminate from router-to-router.

The cryptos are using my serial0 interface. (hub site).

I want to incorporate a remote site that has a PIX506E, using IPSec.

Question: Can I use both GRE (router-to-router) VPNs, and IPSec (PIX-to-router) VPNs on the same interface?

Hub: 3700 GRE Tunnel on Serial0 w/NAT

Spoke: 1700 GRE Tunnel to Hub

Spoke: PIX506E IPSec Tunnel to Hub (one in question)

Is this posssible?

gfullage · ‎01-17-2005

Yep, that should be fine. Really the hub router crypto map has no concept that you're doing GRE/IPSec, all it checks for is matches to its crypto access-lists, which you would have specified as "permit gre from tunnel source to tunnel dest". Because your routing table will show that to get to the remote sites it has to route over the particular GRE tunnel, the original packet will be encapsulated in GRE and the access-list will match.

All you need to do is add another crypto map instance to your existing crypto map on the Serial int, and define the remote peer (PIX) and transform set as normal. When you define the access-list it will be from your network behind the hub router to the network behind the PIX, rather than just the GRE traffic over the tunnel. The hub routers' routing table will have to show that to get to the PIX peer address and to the network behind the PIX that it sends the traffic straight out the Serial int.

mmandel · ‎01-17-2005

Oh wow, that is excellent news. I didn't think I could create multiple crypto maps on same interface.

I will try that, ..and report back!

Thanks for your help.

mmandel · ‎01-17-2005

Uhh, that didn't work?

When I created a new crypto map, and applied it to the Serial interface, it replace the map that was already there, and it broke my GRE Tunnels.

Please advise?

gfullage · ‎01-17-2005

Woah there, I didn't say create a 2nd crypto map, I said create a new instance of the same crypto map, my apologies if I wasn't clear enough. As you've just found out, you cna only have one crypto map on an interface.