l Internet Router A Router D 10.100.100.100/32 GRE tunnel 10.200.200.200/32 172.16.0.0/24 Figure 12-5. GRE through VPN The configuration for this example is identical with regard to EIGRP and the tunnel. The difference is that in this case, there is no RIP in the middle. Routes to the remote end of the VPN tunnel are default routes for the VPN concentrators because they will have public IP addresses. The VPN concentrators will provide the capability to see the remote router's loopback address through static routes. This is a relatively common application of GRE, and one that is necessary when you're running routing protocols over a VPN. The risk of recursive routing is still present, though, SO you must take care to prevent the remote loopback networks from being included in the EIGRP routing processes. GRE and Access Lists GRE is a protocol on the same level as TCP and UDP. When configuring a firewall to allow GRE, you do not configure a port like you would for Telnet or SSH. Instead, must configure the firewall to allow protocol 47. Cisco routers offer the keyword gre for configuring access lists: (config)#access-list 101 permit ? <0-255> An IP protocol number Authentication Header Protocol eigrp Cisco's EIGRP routing protocol Encapsulation Security Payload Cisco's GRE tunneling Internet Control Message Protocol Internet Gateway Message Protocol Cisco's IGRP routing protocol Any Internet Protocol ipinip IP in IP tunneling KA9Q NOS compatible IP over IP tunneling OSPF routing protocol Payload Compression Protocol Protocol Independent Multicast Transmission Control Protocol User Datagram Protocol Chapter 12: Tunnels PIX firewalls also support the keyword gre: PIX (config) #access-list In permit gre host 10.10.10.10 host 20.20.20.20 The Point-to-Point Tunneling Protocol (PPTP) uses GRE, SO if you're using this pro- tocol for VPN access, you will need to allow GRE on your firewall. GRE and Access Lists CHAPTER 13 First Hop Redundancy When designing a network, eliminating single points of failure should be a priorit