Tunnels

Tunnels take packets from one network, encapsulate them within an IP protocol, and transfer them to another network. This sounds inefficient, and in a sense it is. Why would you want to take perfectly good packets, wrap them up in some other protocol, send them to another location, and unwrap them? For two reasons. First, many protocols can't be routed. If you want to connect two sites using nonroutable protocols, the only way to do so is to wrap the nonroutable protocols within a routable protocol, such as IP. Second, it's increasingly common to use the Internet to connect remote sites to a central office. But this connection has its perils, the most significant of which is security. Do you really want corporate data flowing over the public Internet? To minimize security problems, you can establish a tunnel between the offices and then encrypt all the traffic on the tunnel.

In this section, we'll first look at how to establish a tunnel, then at how to encrypt the traffic traveling over the tunnel. We won't discuss encapsulating nonroutable protocols within IP in any detail. Figure 13-3 shows two offices connected by an ISP. The ISP has assigned two IP addresses for our use: 192.168.1.1 and 192.168.2.1. The network numbers used by Offices 1 and 2 are 10.10.1.0/24 and 10.10.2.0/24, respectively.

Here's the configuration for Office 1:

Figure 13-3. A tunnel through an ISP

 hostname Office1
 !
 ! Configure the interface tunnel
 interface tunnel1
 ! Use an unnummbered IP address to stay in sync with serial0 and make our
 ! configuration easier
 ip unnumbered serial0
 ! Set up the tunnel's source IP and destination IP, and enable checksums
 tunnel source serial0
 tunnel destination 192.168.2.1
 tunnel checksum
 ! GRE IP is the default tunnel mode, so this command is optional
 ! GRE IP stands for Generic Route Encapsulation over IP
 tunnel mode gre ip
 no shutdown
 !
 ! Configure the serial interface
 interface serial0
 ip address 192.168.1.1 255.255.255.0
 no shutdown
 !
 ! Our ISP is our default route
 ip route 0.0.0.0 0.0.0.0 192.168.1.2
 ! Set up a static route to the other side of the tunnel
 ip route 10.10.2.0 255.255.255.0 tunnel1

The trickiest part of the configuration is the routing. We set up a static default route, and then set up a more specific static route that sends any traffic destined for 10.10.2.0 through the tunnel.

Here's the configuration for Office 2; it's very similar to that for Office 1:

 hostname Office2
 !
 ! Configure the interface tunnel
 ! We used a different name here (tunnel2) just to show that they
 ! don't have to match.
 interface tunnel2
 ! Use an unnummbered IP address to stay in sync with serial0 and make our
 ! configuration easier
 ip unnumbered serial1
 ! Set up the tunnel's source IP and destination IP, and enable checksums
 tunnel source serial1
 tunnel destination 192.168.1.1
 tunnel checksum
 ! GRE IP is the default tunnel mode, so this command is optional
 ! GRE IP stands for Generic Route Encapsulation over IP
 tunnel mode gre ip
 no shutdown
 !
 ! Configure the serial interface
 interface serial1
 ip address 192.168.2.1 255.255.255.0
 !
 ! Default route
 ip route 0.0.0.0 0.0.0.0 192.168.2.2
 ! Set up a static route to the other side of the tunnel
 ip route 10.10.1.0 255.255.255.0 tunnel1

We can ping Office 2 from Office 1 using the tunnel:

 Office1#ping 10.10.2.1

 Type escape sequence to abort.
 Sending 5, 100-byte ICMP Echos to 10.10.2.1, timeout is 2 seconds:
 !!!!!
 Success rate is 100 percent (5/5), round-trip min/avg/max = 68/68/68 ms

 

13.4.1. show Commands for Tunnels

The most useful show commands for tunnels are two that we've already seen: show ip route and show interface. This makes sensetunnels are really just special interfaces, and the most difficult problem with creating tunnels is getting the routing to work correctly.

The command show ip route shows that we have an active route for the 10.10.2.0 network through the tunnel1 interface:

 office1#show ip route
 Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
 D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
 N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
 U - per-user static route, o - ODR

 Gateway of last resort is 192.168.1.2 to network 0.0.0.0

 10.0.0.0/24 is subnetted, 2 subnets
 C 10.10.1.0 is directly connected, Ethernet0
 S 10.10.2.0 is directly connected, Tunnel1
 C 192.168.1.0/24 is directly connected, Serial0
 S* 0.0.0.0/0 [1/0] via 192.168.1.2

The command show interface tunnel1 gives results like any other show interface command. We see that the interface is up, the hardware associated with the interface is Tunnel (i.e., this is a virtual interface rather than a specific hardware interface), the encapsulation is TUNNEL, and the source and destination ports are properly set.

 office1#show interface tunnel 1
 Tunnel1 is up, line protocol is up
 Hardware is Tunnel
 Interface is unnumbered. Using address of Serial0 (192.168.1.1)
 MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec, rely 255/255, load 1/255
 Encapsulation TUNNEL, loopback not set, keepalive set (10 sec)
 Tunnel source 192.168.1.1 (Serial0), destination 192.168.2.1
 Tunnel protocol/transport GRE/IP, key disabled, sequencing disabled
 Checksumming of packets enabled, fast tunneling enabled
 Last input never, output never, output hang never
 Last clearing of "show interface" counters never
 Queueing strategy: fifo
 Output queue 0/0, 0 drops; input queue 0/75, 0 drops
 5 minute input rate 0 bits/sec, 0 packets/sec
 5 minute output rate 0 bits/sec, 0 packets/sec
 0 packets input, 0 bytes, 0 no buffer
 Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
 0 packets output, 0 bytes, 0 underruns
 0 output errors, 0 collisions, 0 interface resets
 0 output buffer failures, 0 output buffers swapped out