CloudLabBox
Try the free demo

Network+ lab 19 of 27

Site-to-site VPN: GRE tunnel protected by IPsec

Join head office and a branch across the internet. You build a GRE tunnel and run OSPF over it, prove from the provider's router that GRE is readable by anyone in the path, then protect the tunnel with IPsec and watch the same traffic turn into ESP.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then CompTIA Network Plus N10-009 guided labs, then 19 - Site-to-site VPN - GRE tunnel protected by IPsec

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
5 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

Harbour Logistics wants its branch (R2) to reach head office (R1) without paying for a private circuit. Both sites have ordinary internet connections, so you'll build a site-to-site VPN: a tunnel across the internet that carries private traffic and is encrypted so that the provider, or anyone else in the path, can't read it. The provider's router is a Linux box (ISP), so you can capture exactly what crosses the internet.

DeviceInterfaceAddressNotes
R1Gi0/010.10.10.1/24HQ LAN, H1 by DHCP
R1Gi0/1198.51.100.2/30internet, default route to ISP
ISPeth0 / eth1198.51.100.1/30 / 203.0.113.1/30provider router
R2Gi0/1203.0.113.2/30internet, default route to ISP
R2Gi0/010.20.20.1/24branch LAN, PC2 10.20.20.10
R1 / R2Tunnel0172.16.0.1/30 / 172.16.0.2/30the VPN tunnel

VPN settings (teaching values): IKE phase 1 AES-256, SHA-256, DH group 14, pre-shared key Harb0ur-VPN-2026; IPsec ESP AES-256 with SHA-256 HMAC, transport mode.

What you’ll practise

  • Explain site-to-site and client-to-site VPNs, full and split tunnels
  • Build a GRE tunnel and run a routing protocol across it
  • Capture tunnel traffic in transit and recognise GRE, IKE and ESP
  • Protect the tunnel with IPsec: IKE phase 1 policy, pre-shared key, transform set and profile
  • Verify IKE and IPsec security associations and their counters

The tasks

  1. Bring up the provider router
  2. Check the internet path
  3. Build a GRE tunnel and route over it
  4. Read the tunnel from the provider's router
  5. Encrypt the tunnel with IPsec
  6. Prove it's encrypted
  7. Site-to-site versus client-to-site

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Site-to-site VPN - GRE tunnel protected by IPsec5 nodes, 4 links. Every link is listed as text below the diagram.R1ISPR2H1PC2Gi0/0eth0Gi0/1eth0eth1Gi0/1Gi0/0eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to H1 eth0
  • R1 Gi0/1 to ISP eth0
  • ISP eth1 to R2 Gi0/1
  • R2 Gi0/0 to PC2 eth0
Nodes in Site-to-site VPN: GRE tunnel protected by IPsec, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CompTIA Network Plus N10-009 guided labs.

  3. Open 19 - Site-to-site VPN - GRE tunnel protected by IPsec and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network+ labs

All Network+ labs

Related labs in other courses

CloudLabBox is independent of CompTIA, Cisco and Netgate. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.