Understanding the network.pdf - Back to Home

Encrypted GRE Tunnels
To create encrypted GRE tunnels, you need an enterprise plus or plus 40 version of
the IOS software. The tunnel interface configuration is the same as it is in
unencrypted tunnels. However, there are added commands for the exchange of DES
encryption keys, as well as for the creation and application of the encryption maps,
which are used to define what traffic will be encrypted.
After the tunnel interface is created, the first encryption step is to create the DES
key and define the DES encryption algorithms you will use. Here is an example:
bumb(config)#crypto gen-signature-keys vpn
Generating DSS keys ….
[OK]
bumb(config)#crypto algorithm 40-bit-des
NOTE
Encrypted GRE tunnel endpoints need to be configured at the same time because
the router administrators need to actively verify the DES key exchange.
NOTE
Enterprise IOS comes with one encryption engine: the IOS crypto engine. However,
the software encryption engine (as mentioned earlier) places additional load on the
router when used. In addition, two IOS crypto engines, the Cisco RSP7000 and
7500, have the VIP 2 crypto and Encryption Service Adapter (ESA) crypto engines
available. The ESA is also available on the 7200. When using encryption with these
routers, using the VIP2 or ESA crypto engines will result in better performance than
using the IOS crypto engine.
After the DES keys have been created, they need to be exchanged between the
routers that will make up the encrypted tunnel. This exchange is done in global
configuration mode, with both router administrators on the telephone so the DES
key information can be verified. One side is configured as active and the other as
passive. The passive router will wait until the active router connects. After it