Multicast via GRE over IPSec basic questions

drumrb0y · ‎02-19-2007

I'm attempting to configure a GRE tunnel over IPSec to a remote network for the first time; my core 6500 switch lacks the hardware for this, so I'm trying to implement two 1700 routers as the headends in both networks.

Are 1700s up to the task of this implementation, or are other routers required?

Can a VPN endpoint device also be a GRE headend device?

Thanks,

Marc

dominic.caron · ‎02-19-2007

Hi,

A 1711 can do this...but not fast. If I remember correctly, you should get 8 Mbps out of this box.

drumrb0y · ‎02-19-2007

Thanks for the post;

I have a 1710 on one end - is it underpowered, or might it work?

8 Mbps should be ok; I'll have to let the performance speak for itself once I get it stood up.

dominic.caron · ‎02-19-2007

1710 is rated a 4 mbps of vpn. 1711 is rated at 15 mbps.

The GRE will degrade performance. In real life, my 1711 with ipsec over gre did 8 mbps using 800 bytes packets.

drumrb0y · ‎02-20-2007

This 1710 will be dedicated for GRE over IPSec traffic, so I hope it will handle the bandwidth.

Thanks!

roluce · ‎02-20-2007

Does your 1700 have the VPN hardware adapter?

We normally find that (depending on exact type of traffic) we can count on a 1721 -WITH- the hardware encryption adapter will push about 1.9mbit (just short of an E1) of mixed traffic (average packet size 1280 bytes) full duplex over GRE/IPSec 3DES.

Your milage may very, but I wouldn't expect much more than that.

Software based encryption will be slower.

Rob

drumrb0y · ‎02-20-2007

My 1710 has a VPN module, so I hope it doesn't degrade the video stream too badly.

Marc