Cisco Cisco 4G LTE Enhanced High-Speed WAN Interface Cards for Europe

Page 37 of 63

8. Site-to-Site IPsec with GRE for Dynamic Routing

Most enterprise deployments need end-to-end rechability using their private IP addresses that are given to end

devices in the branch and central offices. The IP reachability of such a network is managed with the dynamic

routing protocols such as OSPF and EIGRP. These branch and central offices are connected using the Internet

backbone through the service provider network, so tunnels are used to carry the private IP address packets across

the public network. In smaller deployments with fewer branch offices and one central office, it is easier to deploy

GRE tunnels and site-to-site IPsec encryption. GRE tunnels allow use of dynamic routing protocols, and IPsec

helps ensure that the data is encrypted and securely delivered to intended endpoints.

This section provides the details for deployment of 4G as a backup to the primary WAN connection over a DSL

link. Object tracking is used to manage primary backup failover.

Figure 8

shows the network topology of the GRE

based IPSec solution with dynamic routing. The GRE tunnel is configured over the primary DSL and backup 4G

connection. Site-to-site IPsec is used to encrypt the enterprise traffic through GRE tunnels. OSPF is used as a

dynamic routing protocol to maintain Layer 3 convergence among the private IP subnets behind the branch and

central offices. The configuration is followed by commands to verify if the deployment is working as expected.

Troubleshooting tips are provided to debug if the connectivity is not working as expected.

Note: For the point-to-point static GRE tunnel to work, you must subscribe to a service with a publicly routable
static IP address on the cellular interface. Normal 4G LTE connections are provided with a dynamic private IP

address, which cannot be used for the point-to-point static GRE tunnels. Cellular service providers provide static IP

addresses on 4G LTE interfaces as a separate service.

Figure 8. Network Topology for Dynamic Tunneling Using GRE with IPsec Over 4G as Backup