User manual

The diagram above shows a typical GRE scenario, where two NetDefend Firewalls A and B must

communicate with each other through the intervening internal network 172.16.0.0/16.

Any traffic passing between A and B is tunneled through the intervening network using a GRE

tunnel and since the network is internal and not public there is no need for encryption.

Setup for NetDefend Firewall "A"

Assuming that the network 192.168.10.0/24 is lannet on the lan interface, the steps for setting up

NetDefendOS on A are:

1. In the address book set up the following IP objects:

• remote_net_B: 192.168.11.0/24

• remote_gw: 172.16.1.1

• ip_GRE: 192.168.0.1

2. Create a GRE Tunnel object called GRE_to_B with the following parameters:

• IP Address: ip_GRE

• Remote Network: remote_net_B

• Remote Endpoint: remote_gw

• Use Session Key: 1

• Additional Encapulation Checksum: Enabled

3. Define a route in the main routing table which routes all traffic to remote_net_B on the

GRE_to_B GRE interface. This is not necessary if the option Add route for remote network

is enabled in the Advanced tab, since this will add the route automatically.

4. Create the following rules in the IP rule set that allow traffic to pass through the tunnel:

Name Action Src Interface Src Network Dest Interface Dest Network Service

To_B Allow lan lannet GRE_to_B remote_net_B All

From_B Allow GRE_to_B remote_net_B lan lannet All

Setup for NetDefend Firewall "B"

Assuming that the network 192.168.11.0/24 is lannet on the lan interface, the steps for setting up

NetDefendOS on B are as follows:

1. In the address book set up the following IP objects:

• remote_net_A: 192.168.10.0/24

• remote_gw: 172.16.0.1

• ip_GRE: 192.168.0.2

2. Create a GRE Tunnel object called GRE_to_A with the following parameters:

• IP Address: ip_GRE

• Remote Network: remote_net_A

3.3.5. GRE Tunnels Chapter 3. Fundamentals