Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

EIGRP Between Two Networks

Hello All,

I have a network built on GNS3 where I have a router that acts as a Crypto Gateway that connects to another router on a different remote network.

topo.png

This is one portion of the network. I have EIGRP Running on both, the VPN and LAN Routers. I have the same on the other side.

The other side exists on a physical remote network and the VPN Routers on both ends communicate with the public IPs. I can reach LAN-to-LAN.

BUT, I have to create a default route on the LAN routers which I don't want to. I want the EIGRP Routes to traverse between the two VPN routers. Or at least, the VPN router sends a default route to the LAN Router.

I actually prefer if it is possible to traverse the EIGRP Routes.

Everyone's tags (1)
5 REPLIES

EIGRP Between Two Networks

Hi Islam,

An IPSec tunnel only transmits/receives unicast IP traffic so EIGRP messages (OSPF as well) will not be communicated between your VPN routers via IPSec alone.

You will need to create a GRE tunnel between the VPN routers (or LAN routers depending on the requirement) which will allow EIGRP packets to be encapsulated and sent between devices allowing them to establish an EIGRP adjacency. Once EIGRP has established then you will be able to propagate the required routes between your LAN routers.

New Member

Re: EIGRP Between Two Networks

Thank you! I totally forgot about the GRE Tunnels .. I forgot how it was configured. Can you guide me? This is my current configuration:

VPN Router:


crypto isakmp policy 1

encr 3des

hash md5

authentication pre-share

group 2

crypto isakmp key address

!

crypto ipsec transform-set TS esp-3des esp-md5-hmac

!

crypto map CMAP 10 ipsec-isakmp

set peer

set transform-set TS

match address VPN-TRAFFIC

!

interface FastEthernet0/0

ip address 10.10.2.1 255.255.255.0

duplex auto

speed auto

!

interface FastEthernet0/1

ip address 192.168.1.250 255.255.255.0

duplex auto

speed auto

crypto map CMAP

!

router eigrp 50

network 10.10.2.0 0.0.0.255

network 192.168.1.0

no auto-summary

!

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 192.168.1.1

ip route 10.10.4.0 255.255.255.0 ! This is done to overcome the routing issue

!

!

ip access-list extended VPN-TRAFFIC

permit ip 10.10.2.0 0.0.0.255 10.10.4.0 0.0.0.255

permit ip 10.10.0.0 0.0.255.255 any

!

access-list 25 permit 10.10.0.0 0.0.255.255

!

line vty 0 4

access-class 25 in

login local

LAN Router:

interface FastEthernet0/0

ip address 10.10.2.2 255.255.255.0

duplex auto

speed auto

!

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

!

router eigrp 50

network 10.10.2.0 0.0.0.255

no auto-summary

!

ip route 0.0.0.0 0.0.0.0 10.10.2.1

!

access-list 25 permit 10.10.0.0 0.0.255.255

!

line vty 0 4

login local

Best Regards,
Islam M. Nadim.

Re: EIGRP Between Two Networks

Hi Islam,

Example configs below assuming GRE between the VPN routers. New config in bold

VPN Router 1:

crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key address
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac
!
crypto map CMAP 10 ipsec-isakmp
set peer
set transform-set TS
match address VPN-TRAFFIC
!

interface loopback 0

ip address 10.1.1.2 255.255.255.255

!

interface tunnel 0

ip address 10.10.24.1 255.255.255.0

tunnel source loopback 0

tunnel destination 10.1.1.4

!
interface FastEthernet0/0

description LAN
ip address 10.10.2.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
description WAN

ip address 192.168.1.250 255.255.255.0
duplex auto
speed auto
crypto map CMAP
!
router eigrp 50
network 10.10.2.0 0.0.0.255
network 10.10.24.0 0.0.0.255

no auto-summary
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
!
ip access-list extended VPN-TRAFFIC
permit gre host 10.1.1.2 host 10.1.1.4

VPN Router 2:

crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key address
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac
!
crypto map CMAP 10 ipsec-isakmp
set peer
set transform-set TS
match address VPN-TRAFFIC
!

interface loopback 0

ip address 10.1.1.4 255.255.255.255

!

interface tunnel 0

ip address 10.10.24.2 255.255.255.0

tunnel source loopback 0

tunnel destination 10.1.1.2

!
interface FastEthernet0/0

description LAN
ip address 10.10.4.1 255.255.255.0

duplex auto
speed auto
!
interface FastEthernet0/1

description WAN
ip address
duplex auto
speed auto
crypto map CMAP
!
router eigrp 50
network 10.10.4.0 0.0.0.255
network 10.10.24.0 0.0.0.255

no auto-summary
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0

!
!
ip access-list extended VPN-TRAFFIC
permit gre host 10.1.1.4 host 10.1.1.2

New Member

Re: EIGRP Between Two Networks

Hello willwetherman,

     Apologies for the late reply, as per your updated config, will the data traffic pass between the routers, or shall I permit it to the access list?

ip access-list extended VPN-TRAFFIC

permit ip host 10.1.1.4 host 10.1.1.2

Re: EIGRP Between Two Networks

Hi Islam,

The data traffic will be encpsulated by GRE before encryption so you do not need to match the data traffic in the crypto access list.

Will

316
Views
5
Helpful
5
Replies
CreatePlease to create content