GRE ove IPsec

Unanswered Question
Jan 8th, 2009
User Badges:
  • Silver, 250 points or more


I've got my main campus and a remote site connected by an encrypted GRE tunnel. On the policing policy-map on the outgoing interface, my match statement is an ACL trying to match on ESP traffic (the hit counter doesnt increase) and I've added a line for the un-encrypted trafic IPs and this one has hits.

So, why can't I match on my permit ESP host A host B? And how is it possible to have match on the acl (permit ip any to remote site range)? The later should be encrypted when it hit the outbound policy map.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Ivan Martinon Fri, 01/09/2009 - 16:37
User Badges:
  • Cisco Employee,

As far as I know the policy map that you would apply to the interface is for traffic going through that interface rather than ones generated by that interface, if you want to use QoS for this vpn tunnel you need to use the Qos Preclasify feature in the crypto map settings.


This Discussion