16
@3iron's answer gave me the hint that I needed. The notation is denoting that there are multiple NIC interfaces on the router in the diagram and it's making reference to this.
F0/0 - interface #1
F0/1 - interface #2
NOTE: The F indicates that the NIC/port is most likely a Fast Ethernet type of connection.
This diagram from the Cisco website shows them as ...
9
F0/0 and F0/1 look to be router interface notations to highlight a physical connection into the router from the two respective hosts.
Typically they could be:
Fa: FastEthernet
Gi: GigabitEthernet
Ten: Ten GigabitEthernet
9
L2tp and GRE are totally diffrent protocols
GRE is a simple IP packet encapsulation protocol. a GRE tunnel is used when packets need to be sent from one network to another, without being parsed or treated like IP packets by any intervening routers. a GRE tunnel interface comes up as soon as it is configured and it stays up as long as there is a valid ...
5
Serv,
Your tunnel source and destination addresses are wrong. They should be 209.165.122.2 and 64.103.211.2 on RA and the opposite on RB.
There are many different ways to explain this, but essentially, the route to the tunnel endpoint cannot be through the tunnel. In your case, in order to send a packet (from RA) to 192.168.1.2, RA has to encapsulate it ...
5
Yes, what's important to the router is layer 3 interfaces.
You can think of a layer 3 interface as a logical construct, which can be be tied to a VLAN, physical or tunnel interface.
5
Running multicast or multicast based routing protocols does not necessarily require GRE-over-IPsec. "Tunnel based" or "route based" VPN (tunnel mode ipsec ipv4 a.k.a. IPsec Virtual Tunnel Interfaces in cisco lingo) will transport multicast and EIGRP or OSPF happily.
However, GRE is needed when you need to run non-IP protocols across IPSec:
At my former ...
answered Dec 11 '18 at 22:24
Marc 'netztier' Luethi
7,4661 gold badge9 silver badges26 bronze badges
5
So what's the difference between GRE+IPsec and IPsec only?
In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet.
The most common reason for doing this is to allow broadcast and multicast across the tunnel. Neither is supported by IPSec alone. GRE can also encapsulate non-IP ...
4
GRE is just a tunneling protocol - its main reason for existence is toplogy hiding/bypass.
Some examples include:
Tunneling MPLS across a network that may otherwise not support it - MPLS shims are not IP-based, therefore wrapping them in a GRE tunnel allows two routers to appear adjacent when there could be a number of intermediate IP-only devices.
...
4
You could solve this by running VXLAN on the hypervisor using software like FRR. That would imply that you run a full mesh BGP setup between your hypervisors, or use route reflectors. Then, you can create as many VNI's between your hypervisors which can be used as VPC's between virtual machines.
We've done this in a test setup and it seems to work, so we're ...
4
When there's additional overhead eating into the MTU size, there are three basic approaches: increase outer MTU/frame size, decrease inner MTU, or live with fragmentation.
Routers may fragment (for IPv4) but they don't reassemble. Reassembly is done by the end destination. Trying to move reassembly from the end node to the last-hop router has no advantage in ...
3
You have to at least create static host routes pointing to the endpoint IPs of your tunnel to make sure they remain established. Front door vrf is handy if your endpoint is using a dynamic IP address, forcing you to have a default route pointing out the internet circuit. Splitting it into different vrfs allows you create a second default route pointing ...
3
One simple explanation is that R3 needs to determine which tunnel the packet came from. It's often that there may be more than one tunnel terminating on the same interface on R3.
EDIT:
More importantly, if you allow the tunnel configuration on R3 to specify a different endpoint, there's no guarantee that that address is actually on R1-- it could be ...
3
Do not create GRE tunnels - this will appear to your L3 network as two distinct paths to the same site, meaning you'll end up with extra routing complexity you don't need.
GRE will also add overhead to your payload, and reduce your link MTU which you do not want.
On top of all this, GRE does nothing to solve the guaranteed bandwidth issue, for which you ...
3
I think Cisco was referring to the interesting traffic is automatically put into a GRE formed tunnel. Which is different than we normally think of when making a GRE tunnel. Usually it has to do with routing and you need a virtual interface to have an IP address so you have something from R1 to push routes to R2.
Correct, in WCCP you don't have to specify an ...
3
Possible? Generally, yes. However, you need to consider the tunnel outside as well. How effective QoS works depends on a large number of parameters only some of which you have control over.
QoS inside a tunnel makes only sense when the tunnel traffic can't be congested from the outside - you'll need to reserve bandwidth for the tunnel itself as well. The ...
3
No, it should not be GRE.
In both cases as shown (IPSec tunnel mode and transport mode), it's always IPsec encrypting GRE (and whatever it may contain).
Therefore, the outermost header has to be IPSec.
2
The tunnel destination can't be the subnet of the tunnel itself, which is what you have configured. And tunnel source does matter.
2
Yes,
The tunnels IP addresses need to be on their own subnet. The tunnel source and destination identify the points on the network where routers should encapsulate or de-encapsulate the traffic that is sent thru the tunnels. Having a route to your tunnel destination is a requirement for a tunnel interface to show "UP/UP" so really the 192.168.1.0/30 subnet ...
2
You can certainly run OSPF on GRE interfaces and routers will exchange routes quite happily via the GRE tunnel. A GRE interface should be just like any other interface to OSPF, so normal rules would apply for area assignments just the same as they would apply to other interface types.
2
You can't have a destination to a GRE tunnel that hasn't been established yet.
RA:
Tunnel0 is up, line protocol is up (connected)
Hardware is Tunnel
Internet address is 192.168.1.1/30
! Can't have the same IP on the GRE tunnel on both ends
MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,
reliability 255/255, txload 1/255, rxload 1/255
...
2
I think you're looking for the OSPF "Sham-Link" feature. This feature builds virtual OSPF links over an MPLS infrastructure to connect OSPF networks. The feature is available on Cisco and Juniper gear at least.
2
First, if the three sites connect to the data center over WAN circuits with any appreciable latency, layer-2 connections are not a very good idea. Layer-2 must send all the broadcasts across the layer-2 links, and this can degrade performance and eat up expensive WAN bandwidth.
Sending the VoIP over the layer-2 link will force it to compete with the ...
2
Although GRE is developed by Cisco, it doesn't mean that other vendors don't support it. It's became kinda standard in the industry and I have not seen any single vendor who doesn't support it, whether Juniper, Check Point, Fortinet, etc.... And it's also pretty simple to implement on any Linux distribution.
I'd rather getting in contact with the Sales/...
2
While Configuring GRE tunnel you may have specify source and destination address. That Source and destination IP are 1.1.1.10 and 2.2.2.10. These IPs will be routed in the internet and helps to bring up GRE tunnel.
Once tunnel is up we can assign IP between two end point which in this case is 172.16.0.0/24 network. So any tunnel with IP address on top of ...
2
In the outer IP header, it would definitely be 1.1.1.10 / 2.2.2.10, as this is what is used to route the packet to the tunnel endpoint.
Note that you may not even need IP addresses on the tunnel interfaces, you could use ip unnumbered as it's a point-to-point link.
2
Often, you may want to use a loopback, since it will never go down, as the source because you may have a backup path to the other end. It is not always the right thing to do to use the exit interface since it could go down, but there is another interface which could also get you to the other router. Putting it on a loopback will allow the tunnel to continue ...
2
A 'normal' GRE tunnel is a used as a point-to-point connection. A /30 (or even /31) would be a better use of your subnet space. There also exist multipoint GRE tunnels, such as DMVPN. Here you can have multiple tunnel endpoints connected to one tunnel interface. In that case, you will want a bigger subnet.
2
Q1:
Inner Source: 1.1.1.1
Inner Dest: 4.4.4.4
Outer source: 172.16.0.1
Outer Dest: 192.16.0.2
Q2:
The source address is the tunnel source, 172.16.0.1 (for R1-R4 traffic). The inner and outer addresses are not modified.
Q3:
That is only one advantage. There are many uses. Generally, you use a tunnel whenever you need to hide the underlying ...
2
A1: Because normally you need to run PIM protocol in order to achieve end-to-end connectivity for multicast network. PIM doesn't normally run between ISP boundaries. It would be pretty complicated and protocol itself wasn't designed for that scale.
A2: It depends. From networking point of view I would say that Internet is merely a collection of public ...
Only top voted, non community-wiki answers of a minimum length are eligible