fortigate-ipsec-40-mr3

GRE over IPsec (Cisco VPN) configurations Configuring the Cisco router
Configuring routing
Traffic destined for the network behind the Cisco router must be routed to the GRE
tunnel. To do this, create a static route as follows:
In the CLI, using the example values, you would enter
config router static
edit 0
set device gre1
set dst 10.21.101.0 255.255.255.0
end
Configuring the Cisco router
Troubleshooting
Destination
IP/Mask
Enter the IP address and netmask for the network behind the
Cisco router. For example 10.21.101.0 255.255.255.0
Device Select the GRE virtual interface.
Distance Leave setting at default value.
Using Cisco IOS, you would configure the Cisco router as follows, using the addresses
from the example:
config ter
crypto ipsec transform-set myset esp-3des esp-md5-hmac
no mode
exit
no ip access-list extended tunnel
ip access-list extended tunnel
permit gre host 192.168.5.113 host 172.20.120.141
exit
interface Tunnel1
ip address 10.0.1.2 255.255.255.0
tunnel source 192.168.5.113
tunnel destination 172.20.120.141
!
ip route 10.11.101.0 255.255.255.0 Tunnel1
end
clea crypto sa
clea crypto isakmp
For transport mode, change no mode to mode transport.
This is only the portion of the Cisco router configuration that applies to the GRE-over-
IPsec tunnel. For more information, refer to the Cisco documentation.
This section describes some checks and tools you can use to resolve issues with the
GRE-over-IPsec VPN.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 217
http://docs.fortinet.com/