2
ip multicast-routing
crypto isakmp policy 2
 encr 3des
 hash md5
 authentication pre-share
 crypto isakmp key 123 address 1.7.129.10
!
crypto ipsec transform-set remotevpn esp-3des esp-md5-hmac
!
crypto map remotevpn 1 ipsec-isakmp
 set peer 1.7.129.10
 set transform-set remotevpn
 match address 100
!
interface Loopback0
 ip address 10.249.0.157 255.255.255.255
!
interface Tunnel0
 ip address 10.249.6.98 255.255.255.252
 ip pim sparse-mode
 tunnel source 10.249.0.157
 tunnel destination 10.249.254.1
!
interface fa0/0
 ip address 10.249.52.129 255.255.255.192
 ip pim sparse-mode
 crypto map remotevpn
 ip access-group 199 in

Questions,

  1. Why does loopback0 exist? Is it a "virtual interface" for GRE to be able to use tunnel source 10.249.0.157 on Tunnel0 section?
  2. Why do loopback0 and tunnel0 having different IP subnets?
  3. Where is the Phase 2 definition on this config?
2
  • You should really post the entire router configuration. For instance, the ip multicast routing has nothing to do with the rest of the configuration you show, but other, missing configurations may.
    – Ron Maupin
    Feb 19, 2017 at 6:52
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 13, 2017 at 3:01

2 Answers 2

1
  1. Yes, loopback 0 will be used as GRE Tunnel source and it is recommended to use loopback interface as tunnel source because it is always up and could be reachable through different interfaces.

GRE Encpsulation structure

  1. The IP on Tunnel interface is totally different from the Tunnel source and destination.Tunnel source will be used along with tunnel destination in GRE header and the Tunnel interface IP will be used as source when you generate packets from the tunnel interface and then that packets will be encapsulated inside the GRE header.

  2. Below is the phase 2 configuration:

    crypto map remotevpn 1 ipsec-isakmp  
     set peer 1.7.129.10  
     set transform-set remotevpn  
     match address 100  
    crypto ipsec transform-set remotevpn esp-3des esp-md5-hmac  
    

and the access-list 100.

1
  1. There are many reasons for having a loopback interface. Primarily, loopback interfaces never go down. This is useful for things like routing protocols or tunnels that may have more than one way into a router. If one interface into the router goes down, and there are other ways into the router, the protocol(s) using the first interface will automatically be rerouted into another way into the router without bringing down the protocol connection.
  2. A tunnel is a separate interface and it needs its own layer-3 address. The tunnel looks like a point-to-point link with its own network. The source and destination addresses can be on very different networks, but the tunnel link endpoints need to be on the same network.
  3. The phases, including, phase 2, are a function of the VPN setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.