CCNA Security - GRE Tunnel (include HSRP also)

PC1 and PC2 are VPCs
I got a pppoe Connection

Site_1_R1 and Site_2_R1 are the Primary Routers for the topology and other two Routers for the Backup or Redundancy purpose.


Site_1_R1 Configurations ..

 !  
 !  
 version 12.4  
 service timestamps debug datetime msec  
 service timestamps log datetime msec  
 service password-encryption  
 !  
 hostname Site_1_R1  
 !  
 boot-start-marker  
 boot-end-marker  
 !  
 enable secret cisco  
 !  
 no aaa new-model  
 memory-size iomem 5  
 ip cef  
 !  
 !  
 ip auth-proxy max-nodata-conns 3  
 ip admission max-nodata-conns 3  
 !  
 !  
 ip domain name lab.local  
 !  
 !  
 !  
 key chain GRE  
  key 1  
   key-string GRE  
 !  
 !  
 username Admin privilege 15 secret cisco  
 !  
 !  
 !  
 !  
 !   
 !  
 !  
 !  
 interface Tunnel1  
  ip address 10.0.0.1 255.255.255.248  
  keepalive 3 3  
  tunnel source Dialer1  
  tunnel destination Site_2_R1_router_dialer1_IP 
  tunnel key 1  
 !  
 interface FastEthernet0/0  
  no ip address  
  duplex auto  
  speed auto  
  pppoe enable group global  
  pppoe-client dial-pool-number 1  
 !  
 interface FastEthernet0/1  
  ip address 192.168.1.1 255.255.255.0  
  ip nat inside  
  ip virtual-reassembly  
  duplex auto  
  speed auto  
  standby 1 ip 192.168.1.5  
  standby 1 priority 105  
  standby 1 preempt  
  standby 1 authentication md5 key-string SITE1 
  standby 1 mac-address 000a.000b.000a  
  standby 1 track Dialer1  
  standby 1 track Tunnel1  
 !  
 interface Dialer1  
  ip address negotiated  
  ip nat outside  
  ip virtual-reassembly  
  encapsulation ppp  
  dialer pool 1  
  keepalive 60  
  ppp authentication pap callin  
  ppp pap sent-username username password password  
  ppp ipcp dns request  
  ppp ipcp route default  
 !  
 ip forward-protocol nd  
 !  
 no ip http server  
 no ip http secure-server  
 ip nat inside source list NAT interface Dialer1 overload  
 !  
 ip access-list extended NAT  
  deny  ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255  
  permit ip 192.168.1.0 0.0.0.255 any  
 !  
 !  
 !  
 control-plane  
 !  
 !  
 !  
 line con 0  
  exec-timeout 0 0  
  privilege level 15  
  logging synchronous  
 line aux 0  
  exec-timeout 0 0  
  privilege level 15  
  logging synchronous  
 line vty 0 4  
  login local  
 line vty 5 15  
  login  
 !  
 !  
 end    

Site_1_R2 Configurations

 !  
 !  
 version 12.4  
 service timestamps debug datetime msec  
 service timestamps log datetime msec  
 no service password-encryption  
 !  
 hostname Site_1_R2  
 !  
 boot-start-marker  
 boot-end-marker  
 !  
 enable secret cisco  
 !  
 no aaa new-model  
 memory-size iomem 5  
 ip cef  
 !  
 !  
 ip auth-proxy max-nodata-conns 3  
 ip admission max-nodata-conns 3  
 !  
 !  
 ip domain name lab.local  
 !  
 !  
 !  
 key chain GRE  
  key 1  
   key-string GRE  
 !  
 !  
 username Admin privilege 15 secret cisco  
 !  
 !  
 !   
 !  
 !  
 !  
 interface Tunnel2  
  ip address 10.0.0.9 255.255.255.248  
  keepalive 3 3  
  tunnel source Dialer1  
  tunnel destination Site_2_R2_router_dialer1_IP 
  tunnel key 1  
 !  
 interface FastEthernet0/0  
  no ip address  
  duplex auto  
  speed auto  
  pppoe enable group global  
  pppoe-client dial-pool-number 1  
 !  
 interface FastEthernet0/1  
  ip address 192.168.1.2 255.255.255.0  
  ip nat inside  
  ip virtual-reassembly  
  duplex auto  
  speed auto  
  standby 1 ip 192.168.1.5  
  standby 1 preempt  
  standby 1 authentication md5 key-string SITE1  
  standby 1 mac-address 000a.000b.000a  
 !  
 interface Dialer1  
  ip address negotiated  
  ip nat outside  
  ip virtual-reassembly  
  encapsulation ppp  
  dialer pool 1  
  keepalive 60  
  ppp authentication pap callin  
  ppp pap sent-username username password password  
  ppp ipcp dns request  
  ppp ipcp route default  
 !  
 ip forward-protocol nd  
 !  
 no ip http server  
 no ip http secure-server  
 ip nat inside source list NAT interface Dialer1 overload  
 !  
 ip access-list extended NAT  
  deny  ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255  
  permit ip 192.168.1.0 0.0.0.255 any  
 !  
 !  
 !  
 control-plane  
 !  
 !  
 !  
 line con 0  
  exec-timeout 0 0  
  privilege level 15  
  logging synchronous  
 line aux 0  
  exec-timeout 0 0  
  privilege level 15  
  logging synchronous  
 line vty 0 4  
  login local  
 line vty 5 15  
  login  
 !  
 !  
 end  
   

Site_2_R1 Configurations

 !  
 !  
 version 12.4  
 service timestamps debug datetime msec  
 service timestamps log datetime msec  
 service password-encryption  
 !  
 hostname Site_2_R1  
 !  
 boot-start-marker  
 boot-end-marker  
 !  
 enable secret cisco  
 !  
 no aaa new-model  
 memory-size iomem 5  
 ip cef  
 !  
 !  
 ip auth-proxy max-nodata-conns 3  
 ip admission max-nodata-conns 3  
 !  
 !  
 no ip domain lookup  
 ip domain name lab.local  
 !  
 !  
 !  
 key chain GRE  
  key 1  
   key-string GRE  
 !  
 !  
 username Admin privilege 15 secret cisco  
 !  
 !  
 !  
 !  
 !   
 !  
 !  
 !  
 interface Tunnel1  
  ip address 10.0.0.2 255.255.255.248  
  keepalive 3 3  
  tunnel source Dialer1  
  tunnel destination Site_1_R1_router_dialer1_IP  
  tunnel key 1  
 !  
 interface FastEthernet0/0  
  no ip address  
  duplex auto  
  speed auto  
  pppoe enable group global  
  pppoe-client dial-pool-number 1  
 !  
 interface FastEthernet0/1  
  ip address 192.168.2.1 255.255.255.0  
  ip nat inside  
  ip virtual-reassembly  
  duplex auto  
  speed auto  
  standby 1 ip 192.168.2.5  
  standby 1 priority 105  
  standby 1 preempt  
  standby 1 authentication md5 key-string SITE2  
  standby 1 mac-address 0002.0002.0002  
  standby 1 track Dialer1  
  standby 1 track Tunnel1  
 !  
 interface Dialer1  
  ip address negotiated  
  ip nat outside  
  ip virtual-reassembly  
  encapsulation ppp  
  dialer pool 1  
  keepalive 60  
  ppp authentication pap callin  
  ppp pap sent-username username password password  
  ppp ipcp dns request  
  ppp ipcp route default  
 !  
 interface Dialer2  
  no ip address  
 !  
 interface Dialer4  
  no ip address  
 !  
 ip forward-protocol nd  
 !  
 no ip http server  
 no ip http secure-server  
 ip nat inside source list NAT interface Dialer1 overload  
 !  
 ip access-list extended NAT  
  deny  ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255  
  permit ip 192.168.2.0 0.0.0.255 any  
 !  
 !  
 !  
 control-plane  
 !  
 !  
 !  
 line con 0  
  exec-timeout 0 0  
  privilege level 15  
  logging synchronous  
 line aux 0  
  exec-timeout 0 0  
  privilege level 15  
  logging synchronous  
 line vty 0 4  
  login local  
 line vty 5 15  
  login  
 !  
 !  
 end  
   

Site_2_R2 Configurations

 !  
 !  
 version 12.4  
 service timestamps debug datetime msec  
 service timestamps log datetime msec  
 no service password-encryption  
 !  
 hostname Site_2_R2  
 !  
 boot-start-marker  
 boot-end-marker  
 !  
 enable secret cisco  
 !  
 no aaa new-model  
 memory-size iomem 5  
 ip cef  
 !  
 !  
 ip auth-proxy max-nodata-conns 3  
 ip admission max-nodata-conns 3  
 !  
 !  
 no ip domain lookup  
 ip domain name lab.local  
 !  
 !  
 !  
 key chain GRE  
  key 1  
   key-string GRE  
 !  
 !  
 username Admin privilege 15 secret cisco  
 !  
 !  
 !   
 !  
 !  
 !  
 interface Tunnel2  
  ip address 10.0.0.10 255.255.255.248  
  keepalive 3 3  
  tunnel source Dialer1  
  tunnel destination Site_1_R2_router_dialer1_IP  
  tunnel key 1  
 !  
 interface FastEthernet0/0  
  no ip address  
  duplex auto  
  speed auto  
  pppoe enable group global  
  pppoe-client dial-pool-number 1  
 !  
 interface FastEthernet0/1  
  ip address 192.168.2.2 255.255.255.0  
  ip nat inside  
  ip virtual-reassembly  
  duplex auto  
  speed auto  
  standby 1 ip 192.168.2.5  
  standby 1 preempt  
  standby 1 authentication md5 key-string SITE2  
  standby 1 mac-address 0002.0002.0002  
 !  
 interface Dialer1  
  ip address negotiated  
  ip nat outside  
  ip virtual-reassembly  
  encapsulation ppp  
  dialer pool 1  
  keepalive 60  
  ppp authentication pap callin  
  ppp pap sent-username username password password  
  ppp ipcp dns request  
  ppp ipcp route default  
 !  
 ip forward-protocol nd  
 !  
 no ip http server  
 no ip http secure-server  
 ip nat inside source list NAT interface Dialer1 overload  
 !  
 ip access-list extended NAT  
  deny  ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255  
  permit ip 192.168.2.0 0.0.0.255 any  
 !  
 !  
 !  
 control-plane  
 !  
 !  
 !  
 line con 0  
  exec-timeout 0 0  
  privilege level 15  
  logging synchronous  
 line aux 0  
  exec-timeout 0 0  
  privilege level 15  
  logging synchronous  
 line vty 0 4  
  login  
 line vty 5 15  
  login  
 !  
 !  
 end  
   

In my example I use,

PC1 ip = 192.168.1.10 with 24 mask
PC2 ip = 192.168.2.10 with 24 mask

Also dialer interface should have your pppoe connection password and Username correctly configured.

below is the .net file for GNS3

Mediafire Link for .net File

if you have any questions regarding the GRE tunnel feel free to comment that..
Thank you ..