Using Gre Tunnel between devices on Same LAN

Hi Everyone,
When we need to use Gre Tunnel on same side means on 2 devices connected to each other on LAN?
Whats is benefit of using GRe Tunnel on LAN ?
Thanks
MAhesh

Typically GRE tunnel is not used on the same side/network.
It is used to connect 2 networks and pass traffic through.
Benefit of GRE is it can participate in the routing protocols so it becomes a hop through the tunnel instead of multiple hops through various devices. Further to that, GRE is also used to tunnel traffic which is not natively supported by those devices where the unsupported type of traffic can't pass through.

Similar Messages

How to use more than one device under same apple ID?

How do you you use more than one device under same apple ID? say for facetime?

You don't. One Device and one Apple ID.

How to use FaceTime with 2 devices on same apple id

My husband and I share an apple ID account, and each of us has an IPad and we want to be able to FaceTime each other, but both devices see us as the same person. Is there a way to separate our devices within the same account?

You each need your own Apple ID. It's the same as trying to call a phone with the same number. You can't.
I suppose you use the same Apple ID to share apps. You can still do that. Just create a new Apple ID for the second user and log into your device using that ID for FaceTime and Messages only. In Settings > iTunes and App Store, use the shared Apple ID.

Trouble using facetime on another device with same apple id

Hi
I am having trouble using facetime with my wife. I have an iPad 2 and she has an IPhone 4S. When we try to facetime, we are able to connect for a few seconds and then it drops off. We are then unable to reconnect. We both have the same apple Id and e-mail address although I am trying to contact her via her mobile number. Any suggestions would be grateful received.

Get an email address (free gmail.com) to use on the iPad.
Using FaceTime http://support.apple.com/kb/ht4319
Troubleshooting FaceTime http://support.apple.com/kb/TS3367
The Complete Guide to FaceTime + iMessage: Setup, Use, and Troubleshooting
http://tinyurl.com/a7odey8
Troubleshooting FaceTime and iMessage activation
http://support.apple.com/kb/TS4268
iOS: FaceTime is 'Unable to verify email because it is in use'
http://support.apple.com/kb/TS3510
Using FaceTime and iMessage behind a firewall
http://support.apple.com/kb/HT4245
iOS: About Messages
http://support.apple.com/kb/HT3529
Set up iMessage
http://www.apple.com/ca/ios/messages/
iOS 6 and OS X Mountain Lion: Link your phone number and Apple ID for use with FaceTime and iMessage
http://support.apple.com/kb/HT5538
How to Set Up & Use iMessage on iPhone, iPad, & iPod touch with iOS
http://osxdaily.com/2011/10/18/set-up-imessage-on-iphone-ipad-ipod-touch-with-io s-5/
Troubleshooting Messages
http://support.apple.com/kb/TS2755
Troubleshooting iMessage Issues: Some Useful Tips You Should Try
http://www.igeeksblog.com/troubleshooting-imessage-issues/
Setting Up Multiple iOS Devices for iMessage and Facetime
http://macmost.com/setting-up-multiple-ios-devices-for-messages-and-facetime.htm l
FaceTime and iMessage not accepting Apple ID password
http://www.ilounge.com/index.php/articles/comments/facetime-and-imessage-not-acc epting-apple-id-password/
FaceTime, Game Center, Messages: Troubleshooting sign in issues
http://support.apple.com/kb/TS3970
Unable to use FaceTime and iMessage with my apple ID
https://discussions.apple.com/thread/4649373?tstart=90
How to Block Someone on FaceTime
http://www.ehow.com/how_10033185_block-someone-facetime.html
My Facetime Doesn't Ring
https://discussions.apple.com/message/19087457
To send messages to non-Apple devices, check out the TextFree app https://itunes.apple.com/us/app/text-free-textfree-sms-real/id399355755?mt=8
How to Send SMS from iPad
http://www.iskysoft.com/apple-ipad/send-sms-from-ipad.html
You can check the status of the FaceTime/iMessage servers at this link.
http://www.apple.com/support/systemstatus/
 Cheers, Tom

When do i have to use a gre over ipsec tunnel? i have heard that when i m using a routing protocol and vpn site to site i need a gre tunnel

i have configured a network with ospf and a vpn site to site without gre tunnel and it works very well. I want to know, when do i have to use gre tunnel over ipsec

Jose,
It sounds like you currently have an IPsec Virtual Tunnel Interface (VTI) configured. By this, I mean that you have a Tunnel interface running in "tunnel mode ipsec ipv4" rather than having a crypto map applied to a physical interface. In the days before VTIs, it was necessary to configure GRE over IPsec in order to pass certain types of traffic across an encrypted channel. When using pure IPsec with crypto maps, you cannot pass multicast traffic without implementing GRE over IPsec. Today, IPsec VTIs and GRE over IPsec accomplish what is effectively the same thing with a few exceptions. For example, by using GRE over IPsec, you can configure multiple tunnels between two peers by means of tunnels keys, pass many more types of traffic rather than IP unicast and multicast (such as NHRP as utilized by DMVPN), and you can also configure multipoint GRE tunnels whereas VTIs are point to point.
Here's a document which discusses VTIs in more depth: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec-ipsec-virt-tunnl.html#GUID-A568DA9D-56CF-47C4-A866-B605804179E1
HTH,
Frank

GRE IPSEC tunnel between 2 cisco routers

Hello all,
I have configure a GRE tunnel between 2 sites on cisco router,although the GRE tunnel works fine.
once i have configure the IPSEC ...tunnel, the same is not stable .it goes down after sometime & keeps going into MM_State
#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst                             src             state                          conn-id status
x.x.x.x. x.x.x.x.x    MM_NO_STATE          0 ACTIVE
although the GRE tunnel works fine
Regards
Tejas

Hi David,
it is quite strange but when i started this discussion my issue was that show crypto isakmp sa shows state as "MM_NO_STATE" but now the problem is different
now today morning, i followed some steps
step 1. configure simple GRE tunnel between my 2 locations , able to ping other end tunnel IP with source tunnel IP all works fine .
step 2. started conditional debug for peer along with crypto isakmp & cryptp ipsec debug on both locations.
step 3 implement the IPSEC config on both the router, i have attach the same in a separate file
Now the problem is IPSEC negotiation has been successful see output below but my tunnel is down
SITE A
sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
114.143.78.X 14.102.64.X    QM_IDLE           1015 ACTIVE
SITE B
#sh crypto isakmp sa | include 14.102.64.X
14.102.64.X    114.143.78.X QM_IDLE          15532 ACTIVE
Now i am not sure why my tunnel is down ???
Please check the attach notepad
Regards
Tejas

Interface Bridging Into GRE Tunnel

Hello all, I was wondering if it is still possible as I know it was never supported to bridge a layer 2 interface directly into a GRE tunnel. I have a customer that currently has a dedicated L2 circuit and a new L3 connection, he wants to move his L2 device to his L3 link to save money on circuits. The issue that I have is he does not want to change his IP addresses and the layer 2 network terminates in another location 20 miles away. The layer 3 routed network is also between both buildings and I can create a GRE tunnel between the 2 locations without touching the Internet. I have tried this using a 2921 router runnning IOS 15.4(2)T1 but the bridge-group command is not available on the GRE tunnel interface.
I have also looked at pseudowire and cannot find the commands related to this, do I need to upgrade my license to security?
Cheers
Stuart

It's a hidden command. Even do, you might get a warning messasge stating this is obsolete and unsupported, it still technically a valid configuration. Legacy, but works.
Keep in mind there are better solutions for this kind of connections. But you can try it, it's simple anyways.
Host1---Fa0/0--R1-------------GRE------------R2--Fa0/0---Host2
1. Create a Loopback intf. on both routers and ensure L3 connectivity between them.
2. Create bridge:
router(config)#bridge 1 protocol ieee
3. Create a GRE tunnel interface (dont configure IP's):
router(config)# interface tun0
router(config-if)# tun source loopback x
router(config-if)# tun destination <other router loopback ip>
router(config-if)# bridge-group 1
**This is a hidden cmd. You will get a warning message, but ignore it**
3. Attach Physical Interface to Bridge as well:
router(config)# interface Fa0/0
router(config-if)# bridge-group 1
4. Configure the Hosts IP addresses to be on the same IP Segment and validate communication between them.
You can try this on GNS3 as well. I made a diagram and a brief explanation at another thread, but really don't remember how to get to it.
Once again, this is legacy and there are better ways to achieve this. But for small implementations this is valid and easier. It also helps to understand the newer versions/enhancements to this as well.
HTH

GRE IPSec between Cisco 2811 and FortiGate 110C

Hello,
Does anybody know if it is possible to configure GRE IPSec tunnel between Cisco 2811 router and FortiGate 110C firewall? I know that FortiGate supports IPSec and GRE tunnels, but maybe somebody succeeded in establishing an IPSec GRE between those routers? Could you also give a link to the appropriate documentation if it is possible?

Hi,
You can configure the GRE tunnel on the 2811.
I'm aware that you can configure sort of a GRE tunnel on the Fortinet as well, but I have not seen a GRE tunnel between a Cisco and other vendor.
I've only seen GRE tunnels between Cisco devices (however I have not tried it to assure you that it will not work :-()
Federico.

How is a GRE tunnel applied to a physical interface?

Within a tunnel's configuration we use the commands, source and destination for the tunnel but how does the physical interface know to use the tunnel? Do the tunnel's source settings override the physical interface? If we only configure a tunnel with the correct source would that interface then send all information out encapsulated in GRE?
If we also configure IPSec on the interface and specify a crypto map to only encrypt the matching traffic would this matching traffic only use the GREtunnel or is all information regardless if it's encrypted in IPSec also be encapsulated in GRE?
Also, I read here: https://supportforums.cisco.com/docs/DOC-3067
"Bind crypto map to the physical (outside) interface if you are running Cisco IOS Software Release 12.2.15 or later. If not, then the crypto map must be applied to the tunnel interface as well as the physical interace."
Why was it necessary to apply the crypto map to both the physical and tunnel interfaces, and why is it not necessary with newer IOS versions?
Thanks for any help! -mark

Mark Mattix wrote:I did some reading on EIGRP and is it correct that the EIGRP Header and Payload (TLV) are encapsulated in an IP packet and addressed to the address, 224.0.0.10? Is this the reason why multicast traffic must be encapsulated first in GRE to travel over the internet? Olivier Pelerin> This is correct
When I set up a site to site VPN using GRE tunnels and an IPSec config on the interfaces would this be considered, IPSec over GRE, or GRE over IPSec? I don't understand that difference.
Olivier Pelerin> See the diagram below - this explain GRE over IPSEC. That's a diagram I did here for a training
On the example packet I posted above, is the public address that's routed over the internet part of the IPSec packet/suite? I guess a better question is, what portions of the packet make up IPSec and which portion is just regular IPv4 addressing?
Olivier Pelerin> the diagram below should answer that
I've been wrong in thinking that GRE and IPSec go hand in hand when infact it's possible to only use IPSec and no type of tunnel. If IPSec is set up on the interfaces and the tunnels are configured at both end points, what does your information first get encapsulated by, GRE or IPSec? In your example packet format Olpeleri, is looks like the IP packet is first encapsulated in GRE then encapsulated by IPSec. Is this correct? If so when information leaves our LAN and heads to the internet, does it first go through the tunnel to be encapsulated by GRE then out the physical link that adds the IPSec encapsulation?
Olivier Pelerin> Correct. GRE first then encryption
Sorry for all these questions, I'm just trying to learn how this works! Thanks again for the help!
[red = encrypted]

URGENT - tag-switching over gre-tunnel - how ??

hi,
my problem is that i want to connect two pe-router
over a gre-tunnel.
this is because between the two pe´s i unfortunatly have two cisco828 router as modemrouter inbetween which do no tag-switching.
so i decided to use a gre tunnel between the two pe´s to do tag-switching.
but if i want to forward packets greater than 1492 bytes and the df-bit is set - no chance.
here is the figure and config of the two tunnels:
c3640 - c828 -LINE- c828 - c3640
<==========TUNNEL===============>
first c3640:
interface Tunnel65052
description PE-PE Verbdg. Hoersching-Pasching
ip unnumbered Loopback0
ip mtu 1512
load-interval 30
tag-switching mtu 1512
tag-switching ip
keepalive 10 3
tunnel source 10.20.192.3
tunnel destination 10.20.192.6
second c3640:
interface Tunnel65052
description PE-PE Verbdg. Hoersching-Pasching
ip unnumbered Loopback0
ip mtu 1512
load-interval 30
tag-switching mtu 1512
tag-switching ip
keepalive 10 3
tunnel source 10.20.192.6
tunnel destination 10.20.192.3
on the 828 router i did no adjustment of mtu !
if i do a ping:
r-enns1#pi vrf lkg 172.16.169.121 size 1492 df
Type escape sequence to abort.
Sending 5, 1492-byte ICMP Echos to 172.16.169.121, timeout is 2 seconds:
Packet sent with the DF bit set
Success rate is 100 percent (5/5), round-trip min/avg/max = 208/211/212 ms
r-enns1#
r-enns1#
r-enns1#
r-enns1#
r-enns1#pi vrf lkg 172.16.169.121 size 1493 df
Type escape sequence to abort.
Sending 5, 1493-byte ICMP Echos to 172.16.169.121, timeout is 2 seconds:
Packet sent with the DF bit set
M.M.M
Success rate is 0 percent (0/5)
r-enns1#
please help - thanks

Here's at least two options you could try:
1) Lower the MTU on the tunnel-interface and let PMTU on the endpoints take care of the fragmentation. This could have some serious implications all depending on the systems and applications/protocols used on the network, but in most cases it'll work just fine.
2) Simply remove the DF-bit on incoming packets to the router and lower the MTU on the tunnel-interface and let the router do fragmentation regardless of what the endpoints says. Since you have a 3640 on each end and 828's in the middle, I think it should be capable of this..
You should do a MSS-modification as well in both cases.
Change the MTU like this:
interface Tunnel65052
ip mtu 1488
tag-switching mtu 1500
Then you have set all IP-packets to maximum 1488 bytes (including headers) and let there be room for 3 MPLS labels...
At least I think it should behave like this... please don't kill me if i'm wrong.. :)
Remove the DF-bit with route-map's on the inside interfaces:
interface FastEthernet1/0.100
description inside interface
ip policy route-map clear-df
ip tcp adjust-mss 1424
route-map clear-df permit 10
set ip df 0

QOS - GRE Tunnel, Crypto and Marking within the cloud.

Hi,
We have the following scenario -
|--R1---Z---R2---(cloud)---R3---Z---R4---|
|-----------GRE Tunnel----------|
Z are external cryptos, we have a GRE tunnel between R1 and R4 (the lines don't line up!!). Traffic passes through the tunnel fine.
We have found that traffic received on R1 ingress with a DSCP has that DSCP maintained through the tunnel, we can also re-mark that traffic on R1 ingress successfully.
The problem is we can't re-mark with a different DSCP when it traverses R2 and R3 (we guess it's because the traffic is encrypted and tunnelled), which are 7507's. We expected to be able to remark the tunnel traffic.
A couple of questions -
1. Should we be able to Re-mark the traffic? For some reason it won't match our class-maps.
2. Is a GRE tunnel the best solution for this?
Thanks.
Mat.

Thanks for the reply. We rebooted the router this morning and it kicked into life!!
A couple of thoughts about your idea, firstly the tunnel was from R1, my interpretation of that command is that it should go on the endpoints of the tunnel? Also the command isn't available on the 7500's.
Thanks again,

Gre tunnel over 2 mpls routers

I have 2 sites and the voice server is in site A and Site B are the remote phones . Right now voice vlan go over the DMVPN we are facing some degraded performance and decided to move voice traffic to mpls .
We need to carry the multicast traffic as well which is not supported over our MPLS circuit. I have no idea why provider is not supporting multicast traffic over mpls circuit.
So we decided to create GRE tunnels to carry multicast traffic over MPLS .We have L3 switches on both sites Site A cisco 4500 and Site B cisco 3850 . and MPLS connectivity is reachable upto L3 core switches. With 3850 we had issue to create tunnels and i have upgraded the IOS after upgrading i came to know no more tunnels are supported on 3850. So cannot have Gre tunnel between our L3 switches over the MPLS.
My Question is can i ask the MPLS provider to setup tunnels on their routers which they are ready to help and point the static routes for voice vlan towards gre tunnels over mpls .
Can you advise any other solution or does this solution would work.?

Aneesh,
Lost of connectivity between the two PEs would indeed cause the GRE tunnel interface to go down, assuming that you configure tunnel keepalives as follow:
int tu0
keepalive
Regards

GRE tunnel feature limitation on Cisco Catalyst 4500X

Hi,
I have a customer with three sites. They have the Cisco catalyst 4500-X at each sites and wish to create GRE tunnels between each of these switches.
I have a vague reference which tells me the Cisco cat 4500-x or any cat 4500 for that matter does have severe limitations when GRE tunnels are created, especially limiting the bandwidth to 70kbps. Its also not recommended for data traffic but control plane traffic.
Please advice.

No experts to answer this?

GRE tunnel could not be used by the hosts connected to the router

Hi,
I am using cisco ASR1013 (RP2) and a Mikrotik Router for setting up a GRE tunnel for LAN to LAN routing over a broadband link. The tunnel works fine (able to ping tunnel end points and also all the connected interfaces on both the Mikrotik and Cisco ASR) but the hosts that are connected directly to the Cisco router interface over a layer 2 cisco switch are unable to connect (ping) the hosts or connected interfaces on the mikrotik side. I am sure its not a mikrotik issue as i dont see any traffic coming through the tunnel using the mikrotik torch utility. There are no ACL's or firewall rules on any of the devices......
Source and destination of the tunnel are public IP's and are pingable via internet (The tunnel is connected and endpoints are pingable)
Mikrotik connected interface IP = 192.168.253.1/24
Mikrotik tunnel end point IP = 192.168.254.1/30
Cisco tunnel end point IP = 192.168.254.2/30
Connected cisco subnet to reach Mikrotik = M.N.O.32/28
Cisco interface IP for LAN = M.N.O.33
Test host IP on the LAN subnet = M.N.O.34
The below is my Cisco config
ASR-1#sh run int tun 1
Building configuration...
Current configuration : 144 bytes
interface Tunnel1
ip address 192.168.254.2 255.255.255.252
ip mtu 1400
tunnel source A.B.C.D
tunnel destination W.X.Y.Z
end
ASR-1#sh run int g0/1/7
Building configuration...
Current configuration : 280 bytes
interface GigabitEthernet0/1/7
description LAN
ip address M.N.O.33 255.255.255.240
ip verify unicast source reachable-via rx
no negotiation auto
cdp enable
end
ASR-1#sh ip ro 192.168.253.1
Routing entry for 192.168.253.0/24
Known via "static", distance 1, metric 0 (connected)
Routing Descriptor Blocks:
* directly connected, via Tunnel1
Route metric is 0, traffic share count is 1
ASR-1#ping 192.168.253.1 so M.N.O.33
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.253.1, timeout is 2 seconds:
Packet sent with a source address of M.N.O.33
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/5/6 ms
ASR-1#pi M.N.O.34
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to M.N.O.34, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
If i try to ping 192.168.253.1 (network connected to Mikrotik) from the host M.N.O.34 (the gateway of this host is M.N.O.33 - Int g0/1/7 of the Cisco ASR), i cannot reach detination - request timed out.... Below are the results of trace and ping from the host connected to ASR G1/0/7
PING TO THE GATEWAY *********
[root@localhost ~]# ping M.N.O.33
PING M.N.O.33 (M.N.O.33) 56(84) bytes of data.
64 bytes from M.N.O.33: icmp_seq=1 ttl=255 time=0.161 ms
64 bytes from M.N.O.33: icmp_seq=2 ttl=255 time=0.143 ms
^C
--- M.N.O.33 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1357ms
rtt min/avg/max/mdev = 0.143/0.152/0.161/0.009 ms
PING TO THE TUNNEL END POINT IN CISCO ASR
[root@localhost ~]# ping 192.168.254.2
PING 192.168.254.2 (192.168.254.2) 56(84) bytes of data.
64 bytes from 192.168.254.2: icmp_seq=1 ttl=255 time=0.141 ms
64 bytes from 192.168.254.2: icmp_seq=2 ttl=255 time=0.141 ms
^C
--- 192.168.254.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1739ms
rtt min/avg/max/mdev = 0.141/0.141/0.141/0.000 ms
PING TO THE TUNNEL ENDPOINT IN MIKROTIK
[root@localhost ~]# ping 192.168.254.1
PING 192.168.254.1 (192.168.254.1) 56(84) bytes of data.
^C
--- 192.168.254.1 ping statistics ---
11 packets transmitted, 0 received, 100% packet loss, time 10413ms
PING TO THE CONNECTED INTERFACE ON MIKROTIK
[root@localhost ~]# ping 192.168.253.1
PING 192.168.253.1 (192.168.253.1) 56(84) bytes of data.
^C
--- 192.168.253.1 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3641ms
TRACE TO THE CONNECTED INTERFACE ON MIKROTIK
[root@localhost ~]# traceroute 192.168.253.1
traceroute to 192.168.253.1 (192.168.253.1), 30 hops max, 60 byte packets
1 M.N.O.33 (M.N.O.33) 0.180 ms 0.156 ms 0.145 ms
2 * * *
3 * * *
4 * * *
5 * * *
Please help

Hi,
Sorry for the delayed response ....Both ends static routes are added for the connected test interfaces.....
Regards,
Mahesh

Configuring SMTP Namespace Sharing between two Exchange Forests on the same LAN

Hi guys, really hoping that someone can help me with configuring SMTP Namespace Sharing between two Exchange Forests on the same LAN.
Basically, I have created a new forest and installed a new exchange organisation in this forest. Both forests are located on the same IP subnet and a two way trust has been created between the forests. Federated sharing has also been configured.
I can use ADMT to migrate the user and computer accounts to the new forest and also migrate test mailboxes over. Ideally, I want to be able to do the mailbox migrations in stages so will need to be able to have mail flowing between the two forests.
I have read over the following article (http://ibrahimnore.wordpress.com/2012/09/06/configuring-smtp-namespace-sharing-between-two-exchange-forests-part-2/)
which is good but it's demonstrating over the internet, can anybody advise how this can be achieved on the local LAN?
Any help greatly appreciated :-)

Hi Gilliano,
Thanks for correct link. I must say this is a very good article indeed, I read the entire article and if you go to the 3rd part of this article, please note the text "DOMAINC.COM is configured as Internal Relay Accepted Domain on both the domains"
This is exactly what I asked you to check. Personally, I understand the method described in this article will work but its very complex to manage and administer, while the easiest option is to configure internal relay at the first place and no need to make
so many DNS changes and customizations to your environment.
The solution really depends on what your requirement is - Since you mentioned that you are migrating stuff over from source to destination - I feel this article is too complex for your situation and not really worth (for your requirement). The setup described
in the article is an excellent choice if you are planning to keep both forests alive for longer duration due to several reasons like compliance or company mergers and so on...
please let me know if my explanation is not clear enough.. we can even even have a one-on-one email conversation too!
All the best!
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. Regards, Siva

Using Gre Tunnel between devices on Same LAN

Similar Messages

Maybe you are looking for