| 顺序 | 先 GRE 封装，再 IPsec 加密 |
|---|---|
| 优点 | 隧道上可跑 OSPF/BGP 邻居与组播 |
| 开销 | GRE 24 字节 + IPsec 约 50 字节起 |
| 应用 | 分支互联需要动态路由的常见形态 |
Cisco 配置示例
Cisco 配置示例
interface Tunnel0
ip address 169.254.10.1 255.255.255.252
tunnel source 198.51.100.1
tunnel destination 203.0.113.2
!
ip access-list extended VPN-TRAFFIC
permit gre host 198.51.100.1 host 203.0.113.2
!
crypto map CMAP 10 ipsec-isakmp
set peer 203.0.113.2
set transform-set TS
match address VPN-TRAFFIC
!
interface GigabitEthernet0/0
ip address 198.51.100.1 255.255.255.0
crypto map CMAP
!
show crypto ipsec sa | include pkts