Learn Computer Networking PNETLab - Site-to-Site VPN (GRE Tunnel & IPsec Security)

#Introduction

In episode 16 you sent internal traffic to the Internet through NAT. But what if two offices want to communicate as if directly connected, when both only have a public Internet connection? The answer is a site-to-site VPN, the topic of episode 17.

We build the VPN in two layers: a GRE tunnel for transporting traffic, then IPsec for encryption. This GRE over IPsec combination is a classic pattern used by hundreds of thousands of enterprise networks worldwide.

#The Need for a Site-to-Site VPN

#Connecting the Headquarters and Branch Securely

The Headquarters (HQ) and Branch are both connected to the Internet, but they must not exchange data in open plaintext. A site-to-site VPN creates an encrypted tunnel over the public Internet so that: traffic between offices crosses the Internet, its contents are encrypted, and both networks look like one large LAN.

#Generic Routing Encapsulation (GRE) Tunnel

#The Virtual Tunnel Interface

GRE wraps the original IP packet inside a new IP packet addressed to the tunnel endpoint on the other side. As a result, unicast IP traffic as well as multicast traffic — such as routing protocol Hellos — can pass through the tunnel. Configure the tunnel on both routers:

configure terminal
interface Tunnel0
 ip address 10.99.0.1 255.255.255.252
 tunnel source g0/1
 tunnel destination 203.0.113.10
exit

tunnel source g0/1 and tunnel destination 203.0.113.10 determine the tunnel entry and exit points. Interface Tunnel0 is then given an IP in a private /30 subnet — the address used for traffic between offices.

#Encrypting the Tunnel with IPsec

#ISAKMP Phase 1 and Phase 2

IPsec works in two phases through the ISAKMP (IKE) protocol:

• Phase 1: builds the Internet Key Exchange (IKE SA) — negotiating the pre-shared key authentication policy, the Diffie-Hellman group, and AES or 3DES encryption. The result is a secure channel for the next negotiation.
• Phase 2: builds the IPsec SA inside that channel — choosing the transform set such as ESP-AES and ESP-SHA used to encrypt actual traffic.

Configure phases 1 and 2 on the HQ side:

configure terminal
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
exit
crypto isakmp key Pn3tLab2026 address 203.0.113.10
crypto ipsec transform-set TRANSIT esp-aes esp-sha-hmac

crypto isakmp policy 10 with authentication pre-share and encr aes configures phase 1, while crypto ipsec transform-set TRANSIT esp-aes esp-sha-hmac determines the phase 2 transform set.

#Securing the GRE Interface with an IPsec Profile

IPsec is then bound to the tunnel through a profile:

configure terminal
crypto ipsec profile TUNNEL_PROFILE
 set transform-set TRANSIT
exit
interface Tunnel0
 tunnel protection ipsec profile TUNNEL_PROFILE
exit

tunnel protection ipsec profile TUNNEL_PROFILE makes all GRE traffic passing through Tunnel0 automatically encrypted with the transform set already defined. Show the phase states:

R1# show crypto isakmp sa
R1# show crypto ipsec sa

show crypto isakmp sa displays the phase 1 state (QM_IDLE means success), and show crypto ipsec sa shows the number of encrypted packets passing through.

#Testing the VPN in PNETLab

Build two routers representing HQ and Branch, both connected to the "Internet" in the middle. Configure the tunnel and IPsec on both sides with symmetric values. Test with a ping from the HQ LAN to the Branch LAN: the packet must arrive without problems even though it crosses the public network. Capture the traffic on the Internet segment with Wireshark — you will see ESP packets whose contents are unreadable, proof that encryption is working.

#Common GRE over IPsec Mistakes

Watch the symmetry: the pre-shared key, transform set, and the peer's tunnel IP address must match on both sides. A phase 1 failure almost always comes from a mismatched key or policy, while a phase 2 failure often comes from an incompatible transform set. Do not forget to add a route to the peer office's subnet through interface Tunnel0.

#Closing

Key takeaways:

• A site-to-site VPN connects two offices securely over the Internet.
• GRE wraps IP packets and supports multicast for routing protocols.
• IPsec phase 1 builds the IKE SA; phase 2 builds the IPsec SA.
• The ESP-AES ESP-SHA transform set determines actual traffic encryption.
• tunnel protection ipsec profile binds encryption to the GRE tunnel.
• show crypto isakmp sa and show crypto ipsec sa are its verification.

In the next episode, episode 18, we add infrastructure services: DHCP server and DHCP relay on a Cisco router, ip helper-address for forwarding broadcast requests between VLANs, plus time synchronization with NTP and centralized log collection with syslog to keep all devices consistent.