The specified IP address is then used for the following:
i. An ICMP Ping can be sent to this tunnel endpoint.
ii. Log messages related to the tunnel will be generated with this IP address as the source.
iii. If NAT is being used then it will not be necessary to set the source IP on the IP rule that
performs NAT on traffic going through the tunnel. This IP address will be used as the
source address for NAT.
• Remote Network
The remote network which the GRE tunnel will connect with.
• Remote Endpoint
This is the IPv4 address of the remote device which the tunnel will connect with.
• Outgoing Routing Table
This defines the routing table to be used for the tunnel itself and not the traffic that it is
carrying. In other words, the table used to look up the tunnel endpoint.
• Use Session Key
A unique number can optionally be specified for the tunnel. This allows more than one GRE
tunnel to run between the same two endpoints. The Session Key value is used to distinguish
between them.
• Additional Encapsulation Checksum
The GRE protocol allows for an additional checksum over and above the IPv4 checksum. This
provides an extra check of data integrity.
The Virtual Routing options are used as with any other interface such as an Ethernet interface
(see Section 3.4.2, “Ethernet Interfaces”). The routing tables specified here apply to the traffic
carried by the tunnel and not the tunnel itself. The route lookup for the tunnel itself is specified
in the earlier option Outgoing Routing Table.
The Advanced settings for a GRE interface are:
• Add route dynamically - This option would normally be checked in order that the routing
table is automatically updated. The alternative is to manually create the required route using
the option Add route statically.
• Address to use as source IP - It is possible to specify a particular IP address as the source
interface IP for the GRE tunnel. The tunnel setup will appear to be initiated by this IP address
instead of the IPv4 address of the interface that actually sets up the tunnel.
This might be done if, for example, if ARP publishing is being used and the tunnel is to be
setup using an ARP published IP address.
GRE and the IP Rule Set
An established GRE tunnel does not automatically mean that all traffic coming from or to that
GRE tunnel is trusted. On the contrary, network traffic coming from the GRE tunnel will be
transferred to the NetDefendOS IP rule set for evaluation. The source interface of the network
traffic will be the name of the associated GRE Tunnel.
Chapter 3: Fundamentals
206
To Next Page
Loading...
