IntermediatePublished 2026-10-28
CCNP Site-to-Site VPN: Encrypt a GRE Tunnel
Today's daily lab
Included with a subscription.
Subscribe to unlockA GRE tunnel already carries OSPF between HQ and the branch, but in clear text across the internet. Protect it with IPsec in transport mode.
Learning objectives
- Build a matching IKE phase 1 policy and key on both routers
- Create a transport-mode transform set and an IPsec profile
- Protect the existing GRE tunnel without changing its routing
Troubleshooting focus
- OSPF drops when only one side is protected: finish both routers
- Packets encrypted but none decrypted: compare the transform sets
Topology
Subscribe to see the full topology.
See plansGrade your work
How this lab is graded
- Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with
access-class, are stated in the guide and do have to match. - Addresses, modes and protocol keywords are exact. An IP address, a subnet mask,
switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide. - Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the
running-config— a change that only exists in a terminal session never reaches the grader. - You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
- Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.
Found a problem with this lab?
Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.