October 15, 2026

GRE Tunnel Protected by IPsec Between R10 and R20

This lab connects R10 and R20 using a GRE tunnel protected by IPsec. GRE carries traffic, including OSPF routing updates, while IPsec…

By Oluwalana Oyewole

1 min read

This lab connects R10 and R20 using a GRE tunnel protected by IPsec. GRE carries traffic, including OSPF routing updates, while IPsec encrypts the GRE packets. This arrangement is commonly called GRE over IPsec.

OSPF is already enabled on all routers to provide connectivity across the physical network. R10 and R20 also establish an OSPF adjacency through the tunnel.

Example Addressing

InterfaceR10R20WAN interface — GigabitEthernet0/0192.0.2.10198.51.100.20Tunnel0172.16.10.1/30172.16.10.2/30

The WAN addresses must already be configured and reachable through the physical network before configuring the tunnel.

R10 Configuration

configure terminal
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 exit
crypto isakmp key LabVPN123 address 198.51.100.20
crypto ipsec transform-set GRE-SET esp-aes 256 esp-sha256-hmac
 mode transport
 exit
crypto ipsec profile GRE-PROFILE
 set transform-set GRE-SET
 exit
interface Tunnel0
 ip address 172.16.10.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 198.51.100.20
 tunnel mode gre ip
 tunnel protection ipsec profile GRE-PROFILE
 ip ospf 1 area 0
 ip ospf network point-to-point
 no shutdown
end

R20 Configuration

configure terminal
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 exit
crypto isakmp key LabVPN123 address 192.0.2.10
crypto ipsec transform-set GRE-SET esp-aes 256 esp-sha256-hmac
 mode transport
 exit
crypto ipsec profile GRE-PROFILE
 set transform-set GRE-SET
 exit
interface Tunnel0
 ip address 172.16.10.2 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination 192.0.2.10
 tunnel mode gre ip
 tunnel protection ipsec profile GRE-PROFILE
 ip ospf 1 area 0
 ip ospf network point-to-point
 no shutdown
end

The tunnel protection ipsec profile command applies IPsec protection directly to the GRE tunnel. Intermediate routers only need to forward the packets between the WAN addresses.

Verification

From R10, generate traffic:

ping 172.16.10.2 source 172.16.10.1

Check both routers:

show interfaces Tunnel0
show ip ospf neighbor
show crypto isakmp sa
show crypto ipsec sa
show ip route

Expected results:

  • Tunnel0 is up/up.
  • R10 and R20 become FULL OSPF neighbors through Tunnel0.
  • The IKEv1 session normally shows QM_IDLE after successful negotiation.
  • IPsec encapsulation and decapsulation counters increase as traffic crosses the tunnel. Tunnel status alone does not prove encryption is working.

Things That Could Cause the Lab to Fail

  • Unreachable WAN addresses: Test connectivity between the tunnel endpoints first.
  • Incorrect tunnel source or destination: Each destination must match the other router's WAN address.
  • Different pre-shared keys or security settings: Both ends must have compatible settings.
  • OSPF mismatch: Tunnel addresses must share a subnet, and OSPF areas and timers must match.
  • Recursive routing: The route to the remote WAN address must remain through the physical network, rather than through Tunnel0.
  • Blocked VPN traffic: An ACL or firewall could block IKE or IPsec.
  • Unsupported crypto commands: Available algorithms depend on the router image.

Shout to Sandbox | PingMyNetwork where I built this lab without worrying about images