GRE Tunnel Lab: Configuration and Verification (Free CCNA Lab)

CCNA Lab Packet Tracer

Give the Branch and HQ routers a path to the Internet.

On R1 and R2, configure a default static route pointing to the ISP router
Check that R1 can ping the public address of R2 (198.51.100.1)

Build a GRE tunnel between R1 and R2.

Interface Tunnel0 on both routers, network 172.16.0.0/30: R1 = .1, R2 = .2
Tunnel source: the GigabitEthernet0/0 interface of each router
Tunnel destination: the public address of the other router

Send the traffic between the two LANs through the tunnel.

On R1, a static route to the HQ LAN 192.168.20.0/24
On R2, a static route to the Branch LAN 192.168.10.0/24
Do not add any routes on the ISP router: it must never learn the private networks

Verify the result.

Tunnel0 is up/up on both routers
R1 can ping 192.168.20.1 using its own LAN address 192.168.10.1 as the source
A traceroute from the Branch LAN to the HQ LAN does not show the ISP router

Topology

Initial configs (addressing only)

R1 (Branch) Initial Config

hostname R1
!
interface Loopback0
 description Branch LAN
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0
 description to ISP
 ip address 203.0.113.1 255.255.255.252
 no shutdown

R2 (HQ) Initial Config

hostname R2
!
interface Loopback0
 description HQ LAN
 ip address 192.168.20.1 255.255.255.0
!
interface GigabitEthernet0/0
 description to ISP
 ip address 198.51.100.1 255.255.255.252
 no shutdown

ISP Initial Config (complete, do not change)

hostname ISP
!
interface GigabitEthernet0/0
 description to R1 (Branch)
 ip address 203.0.113.2 255.255.255.252
 no shutdown
!
interface GigabitEthernet0/1
 description to R2 (HQ)
 ip address 198.51.100.2 255.255.255.252
 no shutdown

Note

Three routers: build it in Packet Tracer (three 2911 routers), in EVE-NG or on real equipment. The loopbacks stand in for the office LANs, so no switches or PCs are needed.

The ISP router only knows its two directly connected public networks, just like a real provider does not route your private 192.168.x.x addresses. That is exactly why the tunnel is needed.

Show the solutiontry the tasks first

Task 1. Default static routes on R1 and R2 towards the ISP.

On R1:

R1(config)#ip route 0.0.0.0 0.0.0.0 203.0.113.2

On R2:

R2(config)#ip route 0.0.0.0 0.0.0.0 198.51.100.2

Verification

R1#ping 198.51.100.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 198.51.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

-> The public addresses can reach each other. Try ping 192.168.20.1 source 192.168.10.1 now: it fails. The packet leaves R1 on the default route, but the ISP has no route to 192.168.20.0/24 and drops it.

Task 2. GRE tunnel between R1 and R2.

A tunnel interface needs three things: its own IP address, a source (the local physical interface or address) and a destination (the public address of the far end). GRE is the default tunnel mode on Cisco IOS, so tunnel mode gre ip does not have to be typed.

On R1:

R1(config)#interface Tunnel0
R1(config-if)#ip address 172.16.0.1 255.255.255.252
R1(config-if)#tunnel source GigabitEthernet0/0
R1(config-if)#tunnel destination 198.51.100.1

On R2:

R2(config)#interface Tunnel0
R2(config-if)#ip address 172.16.0.2 255.255.255.252
R2(config-if)#tunnel source GigabitEthernet0/0
R2(config-if)#tunnel destination 203.0.113.1

Verification

R1#show ip interface brief | include Tunnel
Tunnel0                172.16.0.1      YES manual up                    up

R1#ping 172.16.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

-> A GRE tunnel comes up (up/up) as soon as the router has a route to the tunnel destination; that is why Task 1 comes first. Without the default route the tunnel stays up/down. GRE has no keepalives by default, so the far end may even be switched off and the tunnel still shows up/up.

Task 3. Static routes to the remote LAN through the tunnel.

The next hop is the tunnel address of the other router. Traffic for the remote LAN is then put into Tunnel0, wrapped in a new IP header with the public addresses, and crosses the ISP as ordinary traffic between 203.0.113.1 and 198.51.100.1.

On R1:

R1(config)#ip route 192.168.20.0 255.255.255.0 172.16.0.2

On R2:

R2(config)#ip route 192.168.10.0 255.255.255.0 172.16.0.1

A common mistake: do not let the route to the tunnel destination point into the tunnel itself, for example with a dynamic routing protocol running over Tunnel0 that also advertises the public networks. The router would then try to reach the far end of the tunnel through the same tunnel, and IOS shuts it down with %TUN-5-RECURDOWN: Tunnel0 temporarily disabled due to recursive routing. The public addresses must always be reached over the physical path, here the default route.

Task 4. Verify the result.

R1#show ip route static

R1#show ip route static
Gateway of last resort is 203.0.113.2 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 203.0.113.2
S     192.168.20.0/24 [1/0] via 172.16.0.2

R1 ping between the LANs

R1#ping 192.168.20.1 source 192.168.10.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.10.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

R1 traceroute between the LANs

R1#traceroute 192.168.20.1 source 192.168.10.1
Type escape sequence to abort.
Tracing the route to 192.168.20.1
VRF info: (vrf in name/id, vrf out name/id)
  1 192.168.20.1 1 msec 1 msec *

-> Only one hop: inside the tunnel the ISP router is invisible, because it forwards the outer GRE packet and never touches the inner one. That is the whole idea of an overlay.

R1#show interfaces Tunnel0 (part of the output)

R1#show interfaces Tunnel0
Tunnel0 is up, line protocol is up
  Hardware is Tunnel
  Internet address is 172.16.0.1/30
  Tunnel source 203.0.113.1 (GigabitEthernet0/0), destination 198.51.100.1
  Tunnel protocol/transport GRE/IP

Remember for the exam: GRE adds a new 20-byte IP header and a 4-byte GRE header (24 bytes), can carry multicast and routing protocols such as OSPF, and does not encrypt anything. For a secure site-to-site connection GRE is combined with IPsec.

Save the configuration:

On R1 and R2:

copy running-config startup-config

← All CCNA labs