Re: [cciesecurity] Re: IPSec over GRE -vs- GRE over IPSec

From: Joe Deleonardo (jdeleonardo@cox.net)
Date: Wed Jul 16 2003 - 01:13:12 GMT-3


http://tricolour.net/freeswan/oclug2003-01-30/tvtm.html
 
http://rfc-2828.rfc-index.org/rfc-2828-184.htm
 
Google knows all... :)
      ----- Original Message -----
From: Vik Ahuja
To: Joe Deleonardo ; Szabo, Vilmos ; cciesecurity@yahoogroups.com ;
ccielab@groupstudy.com ; security@groupstudy.com
Sent: Tuesday, July 15, 2003 8:57 PM
Subject: Re: [cciesecurity] Re: IPSec over GRE -vs- GRE over IPSec

Interesting. Even after passing the CCIE lab exam, I am
still trying to research the reason why transport mode is more
efficient than tunnel mode, why do you say this?, I understand
traffic analysis might be important but Cisco seems to be big on
transport mode also. I appreciate your input or if you could point
me in the right direction. Thanks
Vik Ahuja
CCIE # 11958
Joe Deleonardo <jdeleonardo@cox.net> wrote:
      I agree. Adding a GRE tunnel adds additional over
      head. You can send
      unicast routing updates. But that solution looks at
      Voice and Video. I'm
      not up on design issues for voice and video, so I can't
      comment on that
      aspect.

      This example is still GRE over IPSec, not IPSec over
      GRE. The only
      difference in this example that the IPSec tunnel is in
      transport mode.

      Transport mode is more efficient than tunnel mode.
      Transport mode is a mode
      usually established between two hosts, but it can be
      established between two
      security gateways. With transport mode however the IP
      header is not
      encrypted. You can't determine the contents of the
      packets but a traffic
      analysis can be performed. So I guess the question
      would be a case by case
      question. How important is it that traffic analysis
      not be performed?

      The original question is still there. Is there any
      reason to run IPSec over
      GRE. Or is there no such thing? It seems so far that
      the two phrases have
      just been used interchangeably? Even by Cisco. I
      re-read their SAFE paper
      today and they use IPSec over GRE and then at the
      bottom have examples for
      GRE over IPSec.

      ----- Original Message -----
      From: "Szabo, Vilmos"
      <VS183600@exchange.UnitedKingdom.NCR.COM>
      To: "'Joe Deleonardo'" <jdeleonardo@cox.net>;
      <cciesecurity@yahoogroups.com>;
      <ccielab@groupstudy.com>;
      <security@groupstudy.com>
      Sent: Tuesday, July 15, 2003 3:34 PM
      Subject: RE: IPSec over GRE -vs- GRE over IPSec

> Joe,
>
> One scenario for IPSec over GRE is 'IPSec Virtual
      Private Network
      Resilience
> Solutions' see the link:
>
      http://www.cisco.com/en/US/netsol/ns110/ns170/ns171/ns241/netbr09186a0080185
> 726.html
>
> ... but I would argue with the author on this
      solution because it requires
> two GRE tunnels + two IPSec tunnels between Remote
      and Central side.
>
> In my opinion it is more simple and flexible to
      configure single IPSec
> tunnel so that its SRC and DST are terminated on
      Loopback interfaces on
> Remote and Central site routers and a Dynamic Routing
      protocol gives the
> resilency for IPSec tunnel.
>
> Let me know your opinion!
>
> Regards,
>
> Vilmos
>
> -----Original Message-----
> From: Joe Deleonardo [mailto:jdeleonardo@cox.net]
> Sent: 15 July 2003 19:38
> To: cciesecurity@yahoogroups.com;
      ccielab@groupstudy.com;
> security@groupstudy.com
> Subject: Re: IPSec over GRE -vs- GRE over IPSec
>
>
> About the only reason I can think of is if you had a
      requirement to use ah
> and
> you weren't allowed to do NAT before IPSec and NAT
      Transparency is not an
> option.
> ----- Original Message -----
> From: Joe Deleonardo
> To: cciesecurity@yahoogroups.com ;
      ccielab@groupstudy.com ;
> security@groupstudy.com
> Sent: Tuesday, July 15, 2003 10:08 AM
> Subject: IPSec over GRE -vs- GRE over IPSec
>
>
> IPSec over GRE -vs- GRE over IPSec.
>
> Alright is this just a play on words or what? GRE
      over IPSec makes
      sense,
> it's used to transport non unicast traffic.
>
> But why would you want to do IPSec over GRE. Does
      anyone have a link to
      a
> config example? ... if it's something?
>
> Thanks,
>
> Joe
>

      Yahoo! Groups Sponsor
      ADVERTISEMENT
      click here

      To unsubscribe from this group, send an email to:
      cciesecurity-unsubscribe@yahoogroups.com

      Your use of Yahoo! Groups is subject to the Yahoo!
      Terms of Service.



This archive was generated by hypermail 2.1.4 : Wed Aug 06 2003 - 06:52:41 GMT-3