Do the basic configuration

R1:

interface FastEthernet0/0

ip address 1.1.1.1 255.255.255.0

no shut

!

interface Loopback0

ip address 10.1.1.1 255.255.255.255

!

ip route 2.2.2.0 255.255.255.0 1.1.1.3

R3:

interface FastEthernet0/0

ip address 1.1.1.3 255.255.255.0

!

interface FastEthernet0/1

ip address 2.2.2.3 255.255.255.0

!

R2:

interface FastEthernet0/0

ip address 2.2.2.2 255.255.255.0

!

interface Loopback0

ip address 10.2.2.2 255.255.255.255

!

ip route 1.1.1.0 255.255.255.0 2.2.2.3

Generic Routing Encapsulation

R1:

interface Tunnel0

ip address 172.16.1.1 255.255.255.0

tunnel source 1.1.1.1

tunnel destination 2.2.2.2

tunnel mode gre ip

end

R1#sh interfaces tunnel 0

Tunnel0 is up, line protocol is up

Hardware is Tunnel

Internet address is 172.16.1.1/24

MTU 1514 bytes, BW 9 Kbit/sec, DLY 500000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation TUNNEL, loopback not set

Keepalive not set

Tunnel source 1.1.1.1, destination 2.2.2.2

Tunnel protocol/transport GRE/IP

R2:

interface Tunnel1

ip address 172.16.1.2 255.255.255.0

tunnel source 2.2.2.2

tunnel destination 1.1.1.1

tunnel mode gre ip

R2#sh interfaces tunnel 1

Tunnel1 is up, line protocol is up

Hardware is Tunnel

Internet address is 172.16.1.2/24

MTU 1514 bytes, BW 9 Kbit/sec, DLY 500000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation TUNNEL, loopback not set

Keepalive not set

Tunnel source 2.2.2.2, destination 1.1.1.1

Tunnel protocol/transport GRE/IP

Form EIGRP neighborship between R1 and R2 and advertise the loopbacks in EIGRP.
R1:

router eigrp 12

network 10.1.1.1 0.0.0.0

network 172.16.1.0 0.0.0.255

no auto-summary

R2:

router eigrp 12

network 10.2.2.2 0.0.0.0

network 172.16.1.0 0.0.0.255

no auto-summary

%DUAL-5-NBRCHANGE: IP-EIGRP(0) 12: Neighbor 172.16.1.1 (Tunnel1) is up: new adjacency

GRE over IPSEC

R1:

crypto isakmp policy 5

authentication pre-share

crypto isakmp key cisco address 2.2.2.2

crypto ipsec transform-set TSET ah-md5-hmac

crypto ipsec profile PROF1

set transform-set TSET

!

interface Tunnel0

tunnel protection ipsec profile PROF1

end

R2:

crypto isakmp policy 10

authentication pre-share

crypto isakmp key cisco address 1.1.1.1

crypto ipsec transform-set TSET ah-md5-hmac

crypto ipsec profile IPSECPROF

set transform-set TSET

!

interface Tunnel1

tunnel protection ipsec profile IPSECPROF

end

We can notice here that two IP headers are same. If we change the propagation mode from tunnel to transport, it'll eliminate one IP Header by which we can save 20 bytes.
R1:

crypto ipsec transform-set TSET ah-md5-hmac

mode transport

R2:

crypto ipsec transform-set TSET ah-md5-hmac

mode transport

Static Virtual Tunnel Interface (SVTI)

R1:

interface tunnel 0

tunnel mode ipsec ipv4
!
crypto ipsec transform-set TSET ah-md5-hmac
mode tunnel
!

R1#show interfaces tunnel 0

Tunnel0 is up, line protocol is up

Hardware is Tunnel

Internet address is 172.16.1.1/24

MTU 1514 bytes, BW 9 Kbit/sec, DLY 500000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation TUNNEL, loopback not set

Keepalive not set

Tunnel source 1.1.1.1, destination 2.2.2.2

Tunnel protocol/transport IPSEC/IP

R2:

interface tunnel 1

tunnel mode ipsec ipv4
!
crypto ipsec transform-set TSET ah-md5-hmac
mode tunnel
!
R2#show interfaces tunnel 0

Tunnel0 is up, line protocol is up

Hardware is Tunnel

Internet address is 172.16.1.2/24

MTU 1514 bytes, BW 9 Kbit/sec, DLY 500000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation TUNNEL, loopback not set

Keepalive not set

Tunnel source 2.2.2.2, destination 1.1.1.1

Tunnel protocol/transport IPSEC/IP