Solved

GRE Trunnel with IPsec Encryption Issue

Posted on 2016-10-19
3
55 Views
Last Modified: 2016-10-20
Currently have a MikroTik switch hosting GRE tunnels with IPSec encryption (Site A).  We have multiple other sites with other MikroTik's directly connected to the internet setup that are working great.

We have this one site (Site B) where the MikroTik switch is behind a Cisco ASA 5505.  However the tunnel is not functioning properly, one side of the GRE tunnel can see the other but not the other way around.

Here's the Cisco ASA Configuration that are relevant, if you need something else let me know.

name 192.168.10.90 MIKROTIK

object-group service MIKROTIK
 service-object gre
 service-object tcp eq 50
 service-object udp eq isakmp
object-group network MIKROTIK_SERVER
 network-object 68.70.xxx.xxx 255.255.255.255

access-list outside_access_in extended permit object-group MIKROTIK object-group MIKROTIK_SERVER host 24.39.xxx.xxx

static (inside,outside) 24.39.xxx.xxx MIKROTIK netmask 255.255.255.255

access-group outside_access_in in interface outside
0
Comment
Question by:Railroad
3 Comments
 
LVL 23

Expert Comment

by:masnrock
ID: 41851812
Is the ASA really necessary if you are talking about the other sites not needing one?

I don't want to assume, but I am guessing that site B is seeing the other side fine, but nothing is able to see site B?
0
 
LVL 14

Accepted Solution

by:
SIM50 earned 500 total points
ID: 41852062
We have this one site (Site B) where the MikroTik switch is behind a Cisco ASA 5505.  However the tunnel is not functioning properly, one side of the GRE tunnel can see the other but not the other way around.

Not sure what you mean. Does it mean the tunnel doesn't establish or you can't send data?

object-group service MIKROTIK
 service-object gre
service-object tcp eq 50
 service-object udp eq isakmp

It should be "service-object esp".
0
 

Author Comment

by:Railroad
ID: 41852340
The ASA is required for this site.

Site A can see Site B as a neighbor, but the OSPF it doesn't form a full adjacency and therefor never exchanges routing tables.  Site B never sees Site A as a neighbor.

Adding "service-object esp" to the object-group service corrected the issue.

Thanks!
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Can't access router via web browser 21 77
Quality settings for cisco routers 8 53
Move configuration from Cisco 3560 to 3750X 6 42
Botnet detection help me please 21 85
Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now