Hi Peter, You can use VTI GRE mode on your side and crypto map on the remote end device . The remote router with crypto map needs to use the same source and destination IP for GRE and the VPN tunnel.
-Rakesh On Thu, Mar 11, 2010 at 11:53 AM, Peter Rathlev <[email protected]> wrote: > Hi Rakesh, > > On Thu, 2010-03-11 at 10:39 -0600, Rakesh Hegde wrote: > > VTI tunnel protection (with or without GRE) should work as they don't > > use crypto map and the IPSEC tunnel is built beforehand. > > The encrypted packets will be label switched just like any other IP > > packet. > > Yes, and though I would like to use VTI the other end are not able to. > So that's a no go. > > > Are you sure you are encrypting the traffic when pinging the other end > > tunnel interface ip ? Do you actually see "sh cry ipsec sa" encrypt > > decrypt count increase when you ping ? > > Yes, traffic originating from the router gets encrypted. Apart from > seeing this traffic in "pkts encaps" and "pkts decaps" I made double > sure by having a firewall in front of the router that only allowed ESP > and not GRE. This was also how I could see the GRE-only traffic in the > first place. > > -- > Peter > > > > > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
