LS-Req received 2 sent 1, LS-Upd received 5 sent 9 Hello received 15 sent 16, DD received 5 sent 6 Neighbor Count is 1, Adjacent neighbor count is 1 Transmit Delay is 1 sec, State Point-To-Point Process ID 0, Router ID 10.1.1.254, Network Type POINTOPOINT, Cost: 100 LS-Req received 0 sent 0, LS-Upd received 0 sent 0 Hello received 0 sent 16, DD received 0 sent 0 Neighbor Count is 0, Adjacent neighbor count is 0 Timer intervals configured, Hello 10.000, Dead 40, Wait 40, Retransmit 5 No backup designated router on this network Transmit Delay is 1 sec, State DR, Priority 1ĭesignated Router (ID) 10.1.1.254, Interface Address 10.1.1.254

Process ID 0, Router ID 10.1.1.254, Network Type BROADCAST, Cost: 1 SPF algorithm last executed 00:01:35.330 ago Number of fully adjacent neighbors in this area is 1 Number of interfaces in this area is 2(2) Number of areas attached to this router: 1 Number of outgoing current DD exchange neighbors 0/5 Number of incomming current DD exchange neighbors 0/5 SPF schedule delay 5 secs, Hold time between two SPFs 10 secs Routing Process 'ospf 0' with ID 10.1.1.254Ĭonforms to RFC2328, and RFC1583Compatibility flag is disabled Static route: default-route to Internet ISP. # ip nat inside source list natAcl interface GigabitEthernet1/0 overload Ip address 10.255.255.2 255.255.255.252 <- overlay subnet over the GRE tunnelĬrypto map gre_over_ipsec <- apply IPsec to the traffic matching the crypto map

# crypto map gre_over_ipsec 10 ipsec-isakmp Ip access-list extended encryptionDomain permit gre host 192.0.2.2 host 198.51.100.1 # crypto ipsec transform-set aes128-sha1-transport esp-aes esp-sha-hmac mode transport

# crypto isakmp key fortinet address 198.51.100.1 The vendors either require an exhaustive list of all local-subnets and all remote-subnets, or they require specification of all the possible combinations of (local remote) subnets.įortiOS supports any-any selectors (src-subnet=0.0.0.0/0 and dst-subnet=0.0.0.0/0). Some vendors do not support negotiating wildcard traffic selectors (namely any-any selectors: src-subnet=0.0.0.0/0 and dst-subnet=0.0.0.0/0). There is therefore no requirement to use GRE-IPsec to carry multicast traffic between two FortiGates. Only the unicast GRE traffic between the GRE endpoints is exposed to IPsec.įortiOS supports multicast traffic directly inside IPsec. The multicast traffic is therefore tunneled in GRE, which itself is protected by IPsec. Some vendors do not support multicast traffic (such as with OSPF or streaming) directly inside an IPsec tunnel. Why a GRE is being used over IPsec tunnel instead of a plain IPsec tunnel

Gre tunnel