No IPSEC applied anywhere yet.

If you have 2 routers configured back-to-back with physical interfaces and tunnel interfaces - which path will traffic travel over?

Answer - it will follow the path from the routing table i suppose. Be it OSPF or static routes or whatever.

Standard enough.

Now add IPSEC alone.

Now OSPF fails as IPSEC does not support multicast.

Standard enough.

Now, add IPSEC and GRE to the mix. Apply the crypto map to both physical and tunnel interfcaes.

Included here is the common ACL that is associated with GRE. That is :-

access-list 100 permit gre host [source physical address] host [destination physical address]

This is the ACL that is supposed to define what traffic is "interesting" and that needs to be encrypted.

Let's repeat the question - where does the traffic go?

I assume its the same answer. Refer to the routing table.

But what traffic is encrypted? Answer - ONLY the traffic that is destined for the tunnel interface IP's.

If you ping from physical to physical it will be unencrypted.

Question - do you need to force ALL traffic down the tunnel interface in order for it to match the ACL and therefore to get encrypted?

How do we accomplish this????

Discussion and debate would be greatly appreciated.

It