Configure IPSec over mGRE with ISAKMP and Transform Sets

300-410 By islever Editorial Last updated

Troubleshoot loop prevention mechanisms (filtering, tagging, split horizon, route poisoning)

Short answer

Configure ISAKMP policy 10 with aes256, sha256, group2, and lifetime 86400. Set ISAKMP keys using 'crypto isakmp key abc123 address <peer_ip>' for spokes and 'address 0.0.0.0' for the hub. Create transform-set T-SET with esp-aes 256 esp-sha-hmac, then create IPSEC-PROFILE referencing T-SET and apply it to Tunnel 0.

Question

SIMULATION
Guidelines
This is a lab item in which tasks will be performed on virtual devices.
• Refer to the Tasks tab to view the tasks for this lab item.
• Refer to the Topology tab to access the device console(s) and perform the tasks.
• Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window.
• All necessary preconfigurations have been applied.
• Do not change the enable password or hostname for any device.
• Save your configurations to NVRAM before moving to the next item.
• Click Next at the bottom of the screen to submit this lab and move to the next question.
• When Next is clicked, the lab closes and cannot be reopened.
Topology
Exhibit: Configure IPSec over mGRE with ISAKMP and Transform Sets
Tasks
Configure IPSec security policy on tunnel interfaces to ensure data confidentiality and integrity where mGRE tunnels are up and running between HUB and SPOKE routers.
  1. Configure the ISAKMP policy parameters with the following attributes:
• AES256
• SHA256
• Group2
• lifetime 86400
  1. Ensure that GRE IP Header should be encrypted inside the IPSec packet. Verify IPSec security association and ISAKMP encrypted key. Use ISAKMP key "abc123".
  2. Configure a flexible ISAKMP Policy on the HUB to add peers that have the dynamic IP addresses where SPOKES must add HUB IP static entry using an encrypted key. Use a single command to configure it. Use IPSec phase-2 transform-set name as T-SET and IPSec Profile name as ’IPSEC-PROFILE’.
Exhibit: Configure IPSec over mGRE with ISAKMP and Transform Sets

Key Takeaways

The core challenge is correctly mapping the ISAKMP parameters to the hub/spoke topology while ensuring the IPSec transform set uses tunnel mode to encrypt the inner GRE headers.

This simulation requires configuring an IPSec security policy to encrypt GRE traffic in a Dynamic Multipoint VPN (DMVPN) scenario, specifically using AES-256, SHA-256, and Group 2 for the ISAKMP phase.

Common mistake: Learners often fail to explicitly configure 'mode tunnel' in the IPsec transform set or neglect the 'authentication pre-share' command within the ISAKMP policy, leading to failed security associations.

Expert Analysis

Why the Answer Is Correct

The solution requires three distinct configuration steps on both Hub and Spoke routers: defining the ISAKMP policy with specific crypto attributes (AES256, SHA256, Group2), setting up the static or dynamic ISAKMP keys, and applying the IPSec profile to the tunnel interface. The critical technical detail is that the IPSec transform set must support tunnel mode (default) to encapsulate the GRE packet, satisfying the requirement to encrypt the GRE IP header.

Why Other Candidate Answers Are Wrong

Incorrect configurations often omit the 'pre-share' authentication method under the ISAKMP policy, causing negotiation failures. Additionally, some candidates incorrectly attempt to use transport mode or forget to apply the crypto map/profile to the tunnel interface, resulting in plaintext GRE or protocol down states. Confusing the ISAKMP key syntax for dynamic peers (0.0.0.0) vs static peers also leads to connectivity issues.

Community Comment Notes

Community feedback highlights that 'mode tunnel' is the default behavior in modern IOS, so explicit entry is not always required but understanding it is vital for the exam logic. Several users noted that the 'authentication pre-share' command is mandatory under the ISAKMP policy sub-mode, a frequent omission point. Others pointed out that NHRP configuration is separate from this specific IPSec task, though both are needed for full DMVPN operation. One user confirmed that the tunnel protocol remains down if the crypto parameters do not match exactly between peers.

Exam Strategy

When configuring IPSec policies in simulations, carefully check the order of commands and ensure all specified parameters (hash, encryption, group) match the prompt exactly. Remember that for mGRE/DMVPN, the tunnel interface itself does not have a destination; the destination is resolved dynamically via NHRP, but the IPSec profile must still be applied.

Frequently Asked Questions

Why is 'mode tunnel' important in the transform set?

It ensures the entire GRE packet (including its header) is encrypted as payload inside the IPSec packet, which is required for DMVPN functionality.

How do I configure ISAKMP keys for dynamic spokes?

Use the command 'crypto isakmp key abc123 address 0.0.0.0 mask 0.0.0.0' on the Hub to accept connections from any dynamic IP.

More 300-410 FAQ →

Discussion 20 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 20

  1. Anonymous learner 👍 8
    i had this lab in the exam, the only differences were: 1. configure MD5 instead of SHA256. 2. the name of ipsec profile was different in the exam (be aware of the details of names in the exam, they are not always the same). on all Routers: (config)#crypto isakmp policy 10 (config-isakmp)#encryption aes256 (config-isakmp)#hash md5 (config-isakmp)#authentication pre-share (config-isakmp)#group 2 (config-isakmp)#lifetime 86400 (config)#crypto isakmp key abc123 address 0.0.0.0 (config)#crypto ipsec transform-set T-SET esp-aes256 esp-md5-hmac (config)#crypto ipsec profile IPSEC-PROFILE (config-ipsec-profile)#set transform-set T-SET (config)#int tunnel 0 (config-if)#tunnel source (phisical interface or phisical ip) (config-if)#tunnel protection ipsec profile IPSEC-PROFILE there´s no need for this command "tunnel mode gre multipoint" cop r st
  2. bf10690 👍 4
    The answer is mostly correct. One thing that is missing is the "mode tunnel" configuration under the transform set. Without it, you won't be encrypting the GRE IP header which is one of the tasks.
  3. 5ef837d 👍 4
    Doesn't seem good as tunnel mode gre multipoint and tunnel destionation are mutually exclusive commands on R1 and R2.
  4. IntangibleW 👍 3
    One thing to note is that "Ensure that GRE IP Header should be encrypted inside the IPSec packet." this requires tunnel mode in ipsec transform set. However it is the default behavior of ipsec transform set, so you don't need to explicit input "mode tunnel" in crypto ipsec transform-set view.
  5. Spectreker 👍 3
    Shouldn't we configure NHRP as well? On the Hub we have to configure Tunnel Mode Gre multipoint
Show 15 more comments
  1. Rabbit3232 👍 2
    It says ISKAMP policy on the peers to add dynamic IP address, and spokes with static so Hub (config)#crypto isakmp key abc123 address 0.0.0.0 Spoke (config)#crypto isakmp key abc123 address X.X.X.X I would not use tunnel mode gre multipoint
  2. test190502 👍 2
    The tunnel interface protocol remains down, how did you succeed? R1#sh ip int b tunnel 0 Interface IP-Address OK? Method Status Protocol Tunnel0 10.0.0.1 YES NVRAM up down
  3. bk989 👍 2
    also mode tunnel is default. And if I remember correctly we use mode tunnel for pre-fragmentation, if I remember correctly
  4. yasinii 👍 2
    You have to add authentication pre-share command under the crypto isakmp policy 10.
  5. Spectreker 👍 2
    I get Protocol down as well
  6. krobo 👍 2
    Seems good
  7. leipeG 👍 1
    I successfully labbed this, assuming all interfaces to the WAN (I used a hub for this), are configured as g0/0 in the 192.168.0.X/24 range. Note, these physical interfaces/ranges are probably different during the exam. #R0 crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 2 lifetime 86400 exit crypto isakmp key abc123 address 0.0.0.0 crypto ipsec transform-set T-SET esp-aes 256 esp-sha256-hmac crypto ipsec profile IPSEC-PROFILE set transform-set T-SET int tunnel 0 tunnel source g0/0 tunnel protection ipsec profile IPSEC-PROFILE ip add 10.0.0.254 255.255.255.0 no shut int g0/0 ip add 192.168.0.254 255.255.255.0 no shut do show crypto isakmp sa do show crypto ipsec sa
  8. leipeG 👍 1
    #R2 crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 2 lifetime 86400 exit crypto isakmp key abc123 address 0.0.0.0 crypto ipsec transform-set T-SET esp-aes 256 esp-sha256-hmac crypto ipsec profile IPSEC-PROFILE set transform-set T-SET int tunnel 0 tunnel source g0/0 tunnel destination 10.0.0.254 tunnel protection ipsec profile IPSEC-PROFILE ip add 10.0.0.2 255.255.255.0 no shut int g0/0 ip add 192.168.0.2 255.255.255.0 no shut do show crypto isakmp sa do show crypto ipsec sa
  9. leipeG 👍 1
    #R1 crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 2 lifetime 86400 exit crypto isakmp key abc123 address 0.0.0.0 crypto ipsec transform-set T-SET esp-aes 256 esp-sha256-hmac crypto ipsec profile IPSEC-PROFILE set transform-set T-SET int tunnel 0 tunnel source g0/0 tunnel destination 10.0.0.254 tunnel protection ipsec profile IPSEC-PROFILE ip add 10.0.0.1 255.255.255.0 no shut int g0/0 ip add 192.168.0.1 255.255.255.0 no shut do show crypto isakmp sa do show crypto ipsec sa
  10. wwwwaaaa 👍 1
    the key is with crypto isakmp key ISAK address 0.0.0.0 on HUB and crypto isakmp key ISAK address <hub physical address> on spokes then configure the Tunnel protection ipsec profile IPSEC_PROFILE on all but all needs to be preconfigured with nhrp, gre multi point, source and network id to work in a lab
  11. Asta2001 👍 1
    Ok, we created policy 10 : crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 2 lifetime 86400 But I don't see in any config that we applied it to the tunnel. Do we need to do that?
  12. SHONA1 👍 1
    Still valid. I had this lab simulation on my exam, it was worded a bit differently, but the core concept is exactly the same.
  13. Kojy 👍 1
    i agree in this sim if tunnel gre mode multipoint is preconfigured we dont need tunnel destination
  14. wwwwaaaa 👍 1
    and the nhrp multicast dynamic/hub ip on all
  15. bk989 👍 1
    I was thinking this too

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Debug IP Packet Timestamps Configuration on R4

S-grade

SNMP ifindex Persist Global vs Interface

S-grade

What Is the Purpose of DHCPv6 Guard?

S-grade

Which Command Enables IP SLA Responder on R201 for TCP Connect?

S-grade

Practice All 300-410 Questions

Access 159 questions with complete answers and detailed explanations.

View Full 300-410 Practice Test →

← Back to 300-410 Study Guide