Configure IPSec over mGRE with ISAKMP and Transform Sets

Troubleshoot loop prevention mechanisms (filtering, tagging, split horizon, route poisoning)
Answer Configure ISAKMP policy 10 with aes256, sha256, group2, and lifetime 86400. Set ISAKMP keys using 'crypto isakmp key abc123 address <peer_ip>' for spokes and 'address 0.0.0.0' for the hub. Create transform-set T-SET with esp-aes 256 esp-sha-hmac, then create IPSEC-PROFILE referencing T-SET and apply it to Tunnel 0.

SIMULATION Guidelines This is a lab item in which tasks will be performed on virtual devices. • Refer to the Tasks tab to view the tasks for this lab item. • Refer to the Topology tab to access the device console(s) and perform the tasks. • Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window. • All necessary preconfigurations have been applied. • Do not change the enable password or hostname for any device. • Save your configurations to NVRAM before moving to the next item. • Click Next at the bottom of the screen to submit this lab and move to the next question. • When Next is clicked, the lab closes and cannot be reopened. Topology exhibit Tasks Configure IPSec security policy on tunnel interfaces to ensure data confidentiality and integrity where mGRE tunnels are up and running between HUB and SPOKE routers. 1. Configure the ISAKMP policy parameters with the following attributes: • AES256 • SHA256 • Group2 • lifetime 86400 2. Ensure that GRE IP Header should be encrypted inside the IPSec packet. Verify IPSec security association and ISAKMP encrypted key. Use ISAKMP key "abc123". 3. Configure a flexible ISAKMP Policy on the HUB to add peers that have the dynamic IP addresses where SPOKES must add HUB IP static entry using an encrypted key. Use a single command to configure it. Use IPSec phase-2 transform-set name as T-SET and IPSec Profile name as ’IPSEC-PROFILE’. exhibit

Community Insight

The core challenge is correctly mapping the ISAKMP parameters to the hub/spoke topology while ensuring the IPSec transform set uses tunnel mode to encrypt the inner GRE headers.

This simulation requires configuring an IPSec security policy to encrypt GRE traffic in a Dynamic Multipoint VPN (DMVPN) scenario, specifically using AES-256, SHA-256, and Group 2 for the ISAKMP phase.

Learners often fail to explicitly configure 'mode tunnel' in the IPsec transform set or neglect the 'authentication pre-share' command within the ISAKMP policy, leading to failed security associations.

Community Discussion (20 comments)

SHONA1 👍 1
Still valid. I had this lab simulation on my exam, it was worded a bit differently, but the core concept is exactly the same.
yasinii 👍 2
You have to add authentication pre-share command under the crypto isakmp policy 10.
Asta2001 👍 1
Ok, we created policy 10 : crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 2 lifetime 86400 But I don't see in any config that we applied it to the tunnel. Do we need to do that?
Rabbit3232 👍 2
It says ISKAMP policy on the peers to add dynamic IP address, and spokes with static so Hub (config)#crypto isakmp key abc123 address 0.0.0.0 Spoke (config)#crypto isakmp key abc123 address X.X.X.X I would not use tunnel mode gre multipoint
IntangibleW 👍 3
One thing to note is that &quot;Ensure that GRE IP Header should be encrypted inside the IPSec packet.&quot; this requires tunnel mode in ipsec transform set. However it is the default behavior of ipsec transform set, so you don't need to explicit input &quot;mode tunnel&quot; in crypto ipsec transform-set view.
wwwwaaaa 👍 1
the key is with crypto isakmp key ISAK address 0.0.0.0 on HUB and crypto isakmp key ISAK address &lt;hub physical address&gt; on spokes then configure the Tunnel protection ipsec profile IPSEC_PROFILE on all but all needs to be preconfigured with nhrp, gre multi point, source and network id to work in a lab
wwwwaaaa 👍 1
and the nhrp multicast dynamic/hub ip on all
Spectreker 👍 2
I get Protocol down as well
test190502 👍 2
The tunnel interface protocol remains down, how did you succeed? R1#sh ip int b tunnel 0 Interface IP-Address OK? Method Status Protocol Tunnel0 10.0.0.1 YES NVRAM up down
leipeG 👍 1
#R2 crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 2 lifetime 86400 exit crypto isakmp key abc123 address 0.0.0.0 crypto ipsec transform-set T-SET esp-aes 256 esp-sha256-hmac crypto ipsec profile IPSEC-PROFILE set transform-set T-SET int tunnel 0 tunnel source g0/0 tunnel destination 10.0.0.254 tunnel protection ipsec profile IPSEC-PROFILE ip add 10.0.0.2 255.255.255.0 no shut int g0/0 ip add 192.168.0.2 255.255.255.0 no shut do show crypto isakmp sa do show crypto ipsec sa
leipeG 👍 1
I successfully labbed this, assuming all interfaces to the WAN (I used a hub for this), are configured as g0/0 in the 192.168.0.X/24 range. Note, these physical interfaces/ranges are probably different during the exam. #R0 crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 2 lifetime 86400 exit crypto isakmp key abc123 address 0.0.0.0 crypto ipsec transform-set T-SET esp-aes 256 esp-sha256-hmac crypto ipsec profile IPSEC-PROFILE set transform-set T-SET int tunnel 0 tunnel source g0/0 tunnel protection ipsec profile IPSEC-PROFILE ip add 10.0.0.254 255.255.255.0 no shut int g0/0 ip add 192.168.0.254 255.255.255.0 no shut do show crypto isakmp sa do show crypto ipsec sa
leipeG 👍 1
#R1 crypto isakmp policy 10 encryption aes 256 hash sha256 authentication pre-share group 2 lifetime 86400 exit crypto isakmp key abc123 address 0.0.0.0 crypto ipsec transform-set T-SET esp-aes 256 esp-sha256-hmac crypto ipsec profile IPSEC-PROFILE set transform-set T-SET int tunnel 0 tunnel source g0/0 tunnel destination 10.0.0.254 tunnel protection ipsec profile IPSEC-PROFILE ip add 10.0.0.1 255.255.255.0 no shut int g0/0 ip add 192.168.0.1 255.255.255.0 no shut do show crypto isakmp sa do show crypto ipsec sa
👍 8
i had this lab in the exam, the only differences were: 1. configure MD5 instead of SHA256. 2. the name of ipsec profile was different in the exam (be aware of the details of names in the exam, they are not always the same). on all Routers: (config)#crypto isakmp policy 10 (config-isakmp)#encryption aes256 (config-isakmp)#hash md5 (config-isakmp)#authentication pre-share (config-isakmp)#group 2 (config-isakmp)#lifetime 86400 (config)#crypto isakmp key abc123 address 0.0.0.0 (config)#crypto ipsec transform-set T-SET esp-aes256 esp-md5-hmac (config)#crypto ipsec profile IPSEC-PROFILE (config-ipsec-profile)#set transform-set T-SET (config)#int tunnel 0 (config-if)#tunnel source (phisical interface or phisical ip) (config-if)#tunnel protection ipsec profile IPSEC-PROFILE there´s no need for this command &quot;tunnel mode gre multipoint&quot; cop r st
Spectreker 👍 3
Shouldn't we configure NHRP as well? On the Hub we have to configure Tunnel Mode Gre multipoint
bf10690 👍 4
The answer is mostly correct. One thing that is missing is the &quot;mode tunnel&quot; configuration under the transform set. Without it, you won't be encrypting the GRE IP header which is one of the tasks.
bk989 👍 2
also mode tunnel is default. And if I remember correctly we use mode tunnel for pre-fragmentation, if I remember correctly
bk989 👍 1
I was thinking this too
Kojy 👍 1
i agree in this sim if tunnel gre mode multipoint is preconfigured we dont need tunnel destination
krobo 👍 2
Seems good
5ef837d 👍 4
Doesn't seem good as tunnel mode gre multipoint and tunnel destionation are mutually exclusive commands on R1 and R2.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The solution requires three distinct configuration steps on both Hub and Spoke routers: defining the ISAKMP policy with specific crypto attributes (AES256, SHA256, Group2), setting up the static or dynamic ISAKMP keys, and applying the IPSec profile to the tunnel interface. The critical technical detail is that the IPSec transform set must support tunnel mode (default) to encapsulate the GRE packet, satisfying the requirement to encrypt the GRE IP header.

Why Other Candidate Answers Are Wrong

Incorrect configurations often omit the 'pre-share' authentication method under the ISAKMP policy, causing negotiation failures. Additionally, some candidates incorrectly attempt to use transport mode or forget to apply the crypto map/profile to the tunnel interface, resulting in plaintext GRE or protocol down states. Confusing the ISAKMP key syntax for dynamic peers (0.0.0.0) vs static peers also leads to connectivity issues.

Community Comment Notes

Community feedback highlights that 'mode tunnel' is the default behavior in modern IOS, so explicit entry is not always required but understanding it is vital for the exam logic. Several users noted that the 'authentication pre-share' command is mandatory under the ISAKMP policy sub-mode, a frequent omission point. Others pointed out that NHRP configuration is separate from this specific IPSec task, though both are needed for full DMVPN operation. One user confirmed that the tunnel protocol remains down if the crypto parameters do not match exactly between peers.

Exam Strategy

When configuring IPSec policies in simulations, carefully check the order of commands and ensure all specified parameters (hash, encryption, group) match the prompt exactly. Remember that for mGRE/DMVPN, the tunnel interface itself does not have a destination; the destination is resolved dynamically via NHRP, but the IPSec profile must still be applied.

Frequently Asked Questions

Why is 'mode tunnel' important in the transform set?

It ensures the entire GRE packet (including its header) is encrypted as payload inside the IPSec packet, which is required for DMVPN functionality.

How do I configure ISAKMP keys for dynamic spokes?

Use the command 'crypto isakmp key abc123 address 0.0.0.0 mask 0.0.0.0' on the Hub to accept connections from any dynamic IP.

More 300-410 FAQ →

Related Analysis

Which control plane process allows the MPLS forwarding state

A-Grade

Refer to the exhibit. Jitter on the link between R101 and R2

A-Grade

An engineer received a ticket about a router that has reload

S-Grade

Practice All 300-410 Questions

Access 159 questions with complete answers and detailed explanations.

View Full 300-410 Practice Test →

← Back to 300-410 Study Guide