ommon layout incorporating GRE over VPN. 10.10.10.0/24 10.20.20.0/24 VPN tunnel Internet Router A Router D 10.100.100.100/32 GRE tunnel 10.200.200.200/32 172.16.0.0/24 Figure 12-5. GRE through VPN The configuration for this example is identical with regard to EIGRP and the tunnel. The difference is that in this case, there is no RIP in the middle. Routes to the remote end of the VPN tunnel are default routes for the VPN concentrators because they will have public IP addresses. The VPN concentrators will provide the ability to see the remote router's loopback address through static routes. This is a relatively common application of GRE, which is necessary when running routing protocols over a VPN. The risk of recursive routing is still present, though, SO care must be taken to prevent the remote loopback networks from being included in the EIGRP routing processes. GRE and Access Lists GRE is a protocol on the same level as TCP and UDP. When configuring a firewall to allow GRE, you do not configure a port like you would for telnet or SSH. Instead, you must configure the firewall to allow protocol 47. Cisco routers offer the keyword gre when configuring access lists: R1(config)# access-list 101 permit ? <0-255> An IP protocol number Authentication Header Protocol eigrp Cisco's EIGRP routing protocol Encapsulation Security Payload Cisco's GRE tunneling Internet Control Message Protocol Internet Gateway Message Protocol Cisco's IGRP routing protocol Any Internet Protocol ipinip IP in IP tunneling KA90 NOS compatible IP over IP tunneling OSPF routing protocol Payload Compression Protocol GRE and Access Lists Protocol Independent Multicast Transmission Control Protocol User Datagram Protocol PIX firewalls also support the keyword gre: PIX(config)# access-list In permit gre host 10.10.10.10 host 20.20.20.20 The Point-to-Point Tunneling Protocol (PPTP) uses GRE, SO if you're using this protocol for VPN access, you will need to allow GRE on your firewall. Chapter 12: Tunnels CHAPTER 13 Resilient Ethernet When designing a n