GRE tunnels
U
SER
G
UIDE
238
set ipsec phase2 TUN0 lifetime 3600 sec
set ipsec phase2 TUN0 protocol 47
set ipsec phase2 TUN0 mode transport
set ipsec phase2 TUN0 security esp
set ipsec phase2 TUN0 level unique
set ipsec phase2 TUN0 remote-subnet
set ipsec pre-shared-key 85.34.166.1 tiesseadm
set ipsec on
To be sure that the network interfaces of the Spoke routers are operative when the tunnel is
activated, use:
set trigger gprs up set gre tun0 on
set trigger gprs up set nhrp on
set trigger gprs up set ipsec on
MPLS
SU
T
UNNEL
GRE
The GRE tunnel can be configured to carry MPLS (MultiProtocol Label Switching) packet, according
to RFC 4023. The tunnel can be configured statically by adding at the commands already described
the configuration of MPLS Label, using the command:
set gre tun0 mpls LABEL-VALUE
or implicitly by the BGP protocol, when it is received an announcement of a VPNv4 network that
contains the value of the Route Discriminator from which you can derive the MPLS Label.
An example of the BGP protocol configuration for this type of application is:
set bgp local-as 1000
set bgp router-id 200.200.200.202
set bgp neighbor 200.200.200.201 remote-as 1000
set bgp neighbor 200.200.200.201 update-source 200.200.200.201
set bgp address-family vpnv4 neighbor 200.200.200.201 activate
set bgp address-family vpnv4 network 192.168.10.0/24 rd 1000:1 tag 0
set bgp on
with which it is announced the
192.168.10.0/24
network, with
label 1.
The correspondent static configuration of the tunnel on the peer becomes:
set gre tun0 name t-mpls
set gre tun0 mpls 1
set gre tunnel-source 200.200.200.1
set gre tunnel-destination 200.200.200.2
set gre tunnel-address 192.168.10.0/24
