GRE Tunnel and static PAT

Hi to all,
I would like to know if it is possible to create a static Port Address Translation (PAT) that would translate a routable IP address to a private address where  a GRE tunnel would end.
In other words, I am trying to see if we can use a static PAT for a GRE tunnel like the one that we can used to reach a HTTP server using a private IP address via static PAT to a routable IP address.
Just trying to see if it is possible to initiate a GRE tunnel from 192.168.1.1 (R1) and used 1.1.1.1 (R2), IP address reachable via internet, as destination address, in the case where we would do a PAT translation on R2 in order to actually terminate the tunnel on R3 router. The static PAT on R2 would translate 1.1.1.1 to 172.16.1.2.
I am basically looking for an equivalent to the following static PAT but for GRE tunnel
          ip nat inside source static tcp 10.10.10.5 80 192.168.2.1 80
Thanks for your help
Stephane

Hello Stephane,
GRE is neither TCP nor UDP, GRE has its own protocol number 47. You can allow the traffic by either by calling GRE instead of TCP or UDP or by just putting a normal IP static NAT entry.
Extended IP access list GRE
    10 permit tcp any any eq 47 log <--- No Hits
    15 permit tcp any any log          <--- No Hits
    20 permit udp any any eq 47 log <--- No Hits
    25 permit udp any any log          <--- No Hits
    30 permit gre any any log (20 matches)
    40 permit ip any any (43 matches)
*Mar  1 00:27:48.435: IP: tableid=0, s=10.10.10.2 (local), d=10.10.10.1 (Tunnel1), routed via FIB
*Mar  1 00:27:48.435: IP: s=10.10.10.2 (local), d=10.10.10.1 (Tunnel1), len 100, sending
*Mar  1 00:27:48.435:     ICMP type=0, code=0
*Mar  1 00:27:48.435: IP: s=192.168.9.5 (Tunnel1), d=192.168.8.2 (FastEthernet0/0), len 124, sending, proto=47
I hope it helps great for you. Please rate if you fell this is helpfull.
Thanks,
Kasi

Similar Messages

  • IP SLA, Tunnels, and static routes

    Here's the scenario:  1 router will have a primary and secondary ISP connection.  I set up an SLA to track connectivity on the primary connection.  Here are the static routes:
    ip route 0.0.0.0 0.0.0.0 Tunnel55 track 10
    ip route 12.54.X.X 255.255.255.240 GigabitEthernet0/0 track 10
    ip route 12.54.X.Y 255.255.255.255 X.15.115.X track 10
    ip route 192.168.32.0 255.255.240.0 Tunnel55 track 10
    ip route 192.168.48.0 255.255.252.0 Tunnel55 track 10
    ip route 192.168.56.0 255.255.255.0 Tunnel55 track 10
    ip route 0.0.0.0 0.0.0.0 Tunnel56 254
    ip route 12.54.X.X 255.255.255.240 GigabitEthernet0/1 254
    ip route 12.54.X.Y 255.255.255.255 X.15.81.X 254
    ip route 192.168.32.0 255.255.240.0 Tunnel56 254
    ip route 192.168.48.0 255.255.252.0 Tunnel56 254
    ip route 192.168.56.0 255.255.255.0 Tunnel56 254
    So I shut down the port (gi0/0) belonging to the primary port.  At this point, it seemed like it worked fine.  The routes shifted over to the backup routes.  However, when I re-enabled the port, only two of the routes switched back. The routes pointing to Tunnels stayed on the secondary tunnel. When I browsed my static routes, I saw this:
    Gateway of last resort is 0.0.0.0 to network 0.0.0.0
    S*    0.0.0.0/0 is directly connected, Tunnel56
          12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
    S        12.x.x.16/28 is directly connected, GigabitEthernet0/0
    S        12.x.y.20/32 [1/0] via x.15.115.x
    S     192.168.32.0/20 is directly connected, Tunnel56
    S     192.168.48.0/22 is directly connected, Tunnel56
    S     192.168.56.0/24 is directly connected, Tunnel56
    Is there something special I need to do for Tunnels to allow the Tunnel routes to switch back automatically?

    Hello Ken,
    I can see you are sending the probe packets to the same object ( using the track ID 10 )
    After you bring the interface tunnel up, can you confirm if you can send traffic to that object?
    Regards,
    Julio

  • When do i have to use a gre over ipsec tunnel? i have heard that when i m using a routing protocol and vpn site to site i need a gre tunnel

    i have configured a network with ospf and a vpn site to site without gre tunnel and it works very well. I want to know, when do i have to use gre tunnel over ipsec

    Jose,
    It sounds like you currently have an IPsec Virtual Tunnel Interface (VTI) configured. By this, I mean that you have a Tunnel interface running in "tunnel mode ipsec ipv4" rather than having a crypto map applied to a physical interface. In the days before VTIs, it was necessary to configure GRE over IPsec in order to pass certain types of traffic across an encrypted channel. When using pure IPsec with crypto maps, you cannot pass multicast traffic without implementing GRE over IPsec. Today, IPsec VTIs and GRE over IPsec accomplish what is effectively the same thing with a few exceptions. For example, by using GRE over IPsec, you can configure multiple tunnels between two peers by means of tunnels keys, pass many more types of traffic rather than IP unicast and multicast (such as NHRP as utilized by DMVPN), and you can also configure multipoint GRE tunnels whereas VTIs are point to point.
    Here's a document which discusses VTIs in more depth: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec-ipsec-virt-tunnl.html#GUID-A568DA9D-56CF-47C4-A866-B605804179E1
    HTH,
    Frank

  • Problem with a simple GRE tunnel

    Hello everyone:
    I have a problem with a simple GRE tunnel, and can not make it work, the problem lies in the instruction "tunnel source loopback-0" if I use this command does not work, now if I use "tunnel source <ip wan >" if it works, someone can tell me why?
    Thanks for your help
    Router 1: 2811
    version 12.4
    no service password-encryption
    hostname cisco2811
    no aaa new-model
    ip cef
    interface Loopback0
    ip address 2.2.2.2 255.255.255.255
    interface Tunnel0
    ip address 10.10.1.1 255.255.255.0
    tunnel source Loopback0
    tunnel destination 217.127.XXX.188
    interface Tunnel1
    ip address 10.10.2.1 255.255.255.0
    tunnel source Loopback0
    tunnel destination 80.32.XXX.125
    interface FastEthernet0/0
    description LOCAL LAN Interface
    ip address 192.168.1.254 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    interface FastEthernet0/1
    description WAN Interface
    ip address 195.77.XXX.70 255.255.255.248
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 195.77.XXX.65
    ip route 192.168.3.0 255.255.255.0 Tunnel0
    ip route 192.168.4.0 255.255.255.0 Tunnel1
    ip nat inside source route-map salida-fibra interface FastEthernet0/1 overload
    access-list 120 deny ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
    access-list 120 deny ip 192.168.1.0 0.0.0.255 192.168.4.0 0.0.0.255
    access-list 120 permit ip 192.168.1.0 0.0.0.255 any
    route-map salida-fibra permit 10
    match ip address 120
    Router 2: 2811
    version 12.4
    service password-encryption
    ip cef
    no ip domain lookup
    multilink bundle-name authenticated
    username admin privilege 15 password 7 104CXXXXx13
    interface Loopback0
    ip address 4.4.4.4 255.255.255.255
    interface Tunnel0
    ip address 10.10.1.2 255.255.255.0
    tunnel source Loopback0
    tunnel destination 195.77.XXX.70
    interface Ethernet0
    ip address 192.168.3.251 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    hold-queue 100 out
    interface ATM0
    no ip address
    no ip route-cache cef
    no ip route-cache
    no atm ilmi-keepalive
    dsl operating-mode auto
    interface ATM0.1 point-to-point
    ip address 217.127.XXX.188 255.255.255.192
    ip nat outside
    ip virtual-reassembly
    no ip route-cache
    no snmp trap link-status
    pvc 8/32
    encapsulation aal5snap
    ip route 0.0.0.0 0.0.0.0 ATM0.1
    ip route 192.168.1.0 255.255.255.0 Tunnel0
    ip nat inside source route-map nonat interface ATM0.1 overload
    access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
    access-list 120 deny ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
    access-list 120 permit ip 192.168.3.0 0.0.0.255 any
    route-map nonat permit 10
    match ip address 120

    Hello, thank you for the answer, as to your question, I have no connectivity within the tunnel, whether from Router 1, I ping 10.10.1.2 not get response ...
    Now both routers remove the loopback, and the interface tunnel 0 change the tunnel source to "tunnel source " tunnel works perfectly, the problem is when I have to use the loopback. Unfortunately achieved when the tunnel work, this will have to endure multicast, and all the examples found carrying a loopback as' source '... but this is a step back ..
    Tunnel0 is up, line protocol is up
    Hardware is Tunnel
    Internet address is 10.10.1.1/24
    MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,
    reliability 255/255, txload 1/255, rxload 1/255
    Encapsulation TUNNEL, loopback not set
    Keepalive not set
    Tunnel source 2.2.2.2 (Loopback0), destination 217.127.XXX.188
    Tunnel protocol/transport GRE/IP
    Key disabled, sequencing disabled
    Checksumming of packets disabled
    Tunnel TTL 255
    Fast tunneling enabled
    Tunnel transmit bandwidth 8000 (kbps)
    Tunnel receive bandwidth 8000 (kbps)
    Last input 09:04:38, output 00:00:19, output hang never
    Last clearing of "show interface" counters never
    Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
    Queueing strategy: fifo
    Output queue: 0/0 (size/max)
    5 minute input rate 0 bits/sec, 0 packets/sec
    5 minute output rate 0 bits/sec, 0 packets/sec
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    11101 packets output, 773420 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 unknown protocol drops
    0 output buffer failures, 0 output buffers swapped out

  • How to setup GRE tunnel on a 3005

    Does the vpn3005 support GRE tunnels and how do I configure it? Reference paper will be fine.
    Thanks
    /Bent

    Yes, VPN 3005 concentrator should support GRE tunnels. Here are some configuration examples for the same.
    Configuring a GRE Tunnel over IPSec with OSPF
    http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800a43f6.shtml.
    For more such examples please refer to:
    http://www.cisco.com/en/US/tech/tk583/tk372/tech_configuration_examples_list.html

  • GRE tunnel limitations

    Please i want to know if the GRE tunnel has limitation for traffic passes over it depend only on physical media.
    Example:if i want 5GIG traffic to pass over GRE tunnel and physical media have BW 10 GIG ,GRE tunnel can handle this amount of traffic or not.

    it's depends on you equipment. if you have something like asr1000 on both sides (or other device which handle gre in hardware), you can achieve speed more than 5gbps.

  • GRE Tunnel QoS

    Hi
    I am looking for adding QoS for GRE Tunnel and found this info
    Where Do I Apply the Service Policy?
    You can apply a service policy to either the tunnel interface or to the underlying physical interface. The decision of where to apply the policy depends on the QoS objectives. It also depends on which header you need to use for classification.
    Apply the policy to a physical interface and enable qos-preclassify on a tunnel interface when you want to classify packets based on the pre-tunnel header.
    In our environment, I am using service policy under serial interface, the source interface of Tunnel is F0/0, so from above info, which interface is "physical interface" for my case, serial or F0/0 ?
    Thanks. Leo

    Hello
    You should determine which one is the physical interface by checking which interface (again, physical) will be used to router GRE packets towards the destination.
    For instance, you state that your tunnel configuration is as follows:
    interface Tunnel0
    ip address 10.0.0.1 255.255.255.252
    tunnel source FastEthernet0/0
    tunnel destination 192.168.1.1
    If the destination ip 192.168.1.1 is routed via your serial interface, then the physical interface that you will use to apply your Output service policy is SerialX/X.
    Your setup seems correct. You only need to review if your policies are correctly configured for the pre-gre header or the GRE encapsulated packets (as stated in the documentation
    Adolfo

  • Vpn tunnels and Nat on Cisco soho 91 routers ??

    Is it possible to create the following, using the soho 91 routers:
    Router A (192.168.1.0) network
    E0 192.168.1.250
    E1 external ip (world ip)
    Router B (192.168.99.0) network
    E0 192.168.99.1
    E1 external ip (world ip)
    Router C (192.168.103.0) network
    E0 192.168.103.1
    E1 external ip (world ip)
    tunnel1 = from Router A to Router B
    tunnel2 = from Router A to Router C
    on Router A
    ip route 192.168.2.0 255.255.255.0 192.168.1.2
    ip route 192.168.3.0 255.255.255.0 192.168.1.3
    ip route 192.168.4.0 255.255.255.0 192.168.1.4
    ip route 192.168.99.0 255.255.255.0 to-tunnel1
    ip route 192.168.103.0 255.255.255.0 to-tunnel2
    ip route nat (everything thing else)
    on Router B
    ip route 192.168.1.0 255.255.255.0 to-tunnel1
    ip route 192.168.103.0 255.255.255.0 to-tunnel1
    ip route nat (everything else)
    on Router C
    ip route 192.168.1.0 255.255.255.0 to-tunnel2
    ip route 192.168.103.0 255.255.255.0 to-tunnel2
    ip route nat (everything else)
    Thanks.
    Wayne

    I assume you are using GRE tunnel and not IPSec. If GRE tunnel, the configuration looks OK except for Router C. The "ip route 192.168.103.0 255.255.255.0 to-tunnel2" should be "ip route 192.168.99.0 255.255.255.0 tunnel2 " pointing to the network connected to Router B. Also the correct command should not have "to-tunnel1", it is simply "tunnel1"

  • How is a GRE tunnel applied to a physical interface?

    Within a tunnel's configuration we use the commands, source and destination for the tunnel but how does the physical interface know to use the tunnel? Do the tunnel's source settings override the physical interface? If we only configure a tunnel with the correct source would that interface then send all information out encapsulated in GRE?
    If we also configure IPSec on the interface and specify a crypto map to only encrypt the matching traffic would this matching traffic only use the GREtunnel or is all information regardless if it's encrypted in IPSec also be encapsulated in GRE?
    Also, I read here: https://supportforums.cisco.com/docs/DOC-3067
    "Bind crypto map to the physical (outside) interface if you are running Cisco IOS  Software Release 12.2.15 or later. If not, then the crypto map must be applied to the tunnel interface as well as the physical interace."
    Why was it necessary to apply the crypto map to both the physical and tunnel interfaces, and why is it not necessary with newer IOS versions?
    Thanks for any help!  -mark

    Mark Mattix wrote:I did some reading on EIGRP and is it correct that the EIGRP Header and Payload (TLV) are encapsulated in an IP packet and addressed to the address, 224.0.0.10? Is this the reason why multicast traffic must be encapsulated first in GRE to travel over the internet? Olivier Pelerin> This is correct
    When I set up a site to site VPN using GRE tunnels and an IPSec config on the interfaces would this be considered, IPSec over GRE, or GRE over IPSec? I don't understand that difference.
    Olivier Pelerin> See the diagram below - this explain GRE over IPSEC. That's a diagram I did here for a training
    On the example packet I posted above, is the public address that's routed over the internet part of the IPSec packet/suite? I guess a better question is, what portions of the packet make up IPSec and which portion is just regular IPv4 addressing?
    Olivier Pelerin> the diagram below should answer that
    I've been wrong in thinking that GRE and IPSec go hand in hand when infact it's possible to only use IPSec and no type of tunnel. If IPSec is set up on the interfaces and the tunnels are configured at both end points, what does your information first get encapsulated by, GRE or IPSec? In your example packet format Olpeleri, is looks like the IP packet is first encapsulated in GRE then encapsulated by IPSec. Is this correct? If so when information leaves our LAN and heads to the internet, does it first go through the tunnel to be encapsulated by GRE then out the physical link that adds the IPSec encapsulation?
    Olivier Pelerin> Correct. GRE first then encryption
    Sorry for all these questions, I'm just trying to learn how this works! Thanks again for the help!
    [red = encrypted]

  • GRE Tunnel/NAT with multiple subnets and interfaces

    So, I am not sure if we are trying to accomplish too many things at once and what we are attempting to do is not possible or if we are missing something in our configurations...
    Here is the situation...
    We are migrating some equipment between datacenters.  The equipment only a has a /27 worth of IP space assigned to it so we cannot simply "move" the IP space to the new datacenter.  Further because we have several VPNs terminated in the old IP space that originate from devices we do not directly control and are essential in continuing to provide service, it was/is difficult to magically update some DNS entries and change IP addresses overnight.  The last twist in this puzzle is that at the new datacenter, we will deploying some new equipment that will be in a separate subnet (with a separate Windows AD structure) but sharing the new public IP space we have in the new datacenter.
    We thought using a GRE tunnel, some trunks, and a bunch of NATs would make the whole process easy and we tested ti in a lab and everything SEEMED to work.  However, when we performed the move we ran into an odd issue that we were unable to figure out and had to go back to a failsafe configuration that has the essentials up and running, but the environment is not running in an ideal way for us to gradually transition as we would like.
    Essentially what we had/have and how it was configured is as follows:
    Site A
    Edge Router - x.x.x.x /24 BGP announcement
    x.x.x.y/27 that is within the /24 that we need at site b
    GRE tunnel configuration
    interface tunnel0
      ip address 10.x.x.1 255.255.255.252
      tunnel source <router edge IP>
      tunnel destination <site b router edge ip>
      keepalive 10 3
    static route for site a public ip to bring it to site b via GRE tunnel
    ip route x.x.x.y 255.255.255.224 10.x.x.2
    Site B
    Edge Router - y.y.y.y /24 BGP announcement
    Similar GRE tunnel configuration (tunnel comes out and works so don't think issue is here)
    2 Vlans (1 for site a ip space, 1 for site b ip space)
    int vlan 50
    ip address x.x.x.1 /27
    int vlan 51
    ip address y.y.y.129 /25
    Trunk port for the VLANs going down to an ASA
    int g1/1
      swi mode trunk
      swi trunk native vlan 51
      swi tru all vlan 50,51
      swi tru en dot1q
    Then on the ASA, I have 2 physical interfaces for 4 logical interfaces (outside, outsideold, inside, insideold)
    int e0/0
     nameif outside
     sec 0
     ip address y.y.y.130 /25
    int e0/0.50
     nameif outsideold
     sec 0
     ip address x.x.x.2 /27
     vlan 51
    int e0/1
      nameif inside
      sec 100
      ip address 192.168.y.1 /24
    int e0/1.60
      nameif insideold
      sec 100
      ip address 192.168.x.1 /24
      vlan 60
    A static route using the new ip space on the native outside interface...
    route 0 0 y.y.y.129
    And then I have some nat rules which is where I think things go a little haywire...
    object network obj-y.y.y.0-24
      subnet y.y.y.0 255.255.255.0
     nat (inside,outside) dynamic interface
    object network obj-x.x.x.0-24
      subnet x.x.x.0 255.255.255.0
     nat (insideold,outside) dynamic interface
    object network obj-y.y.y.135-160
      range y.y.y.135 y.y.y.160
    object network obj-192.168.y.135-160
      range 192.168.y.135 192.168.y.160
      nat (inside,outside) static obj-y.y.y.135-160
    object network obj-x.x.x.10-20
      range x.x.x.10 x.x.x.20
    object network obj-192.168.x.10-20
      range 192.168.x.10 192.168.x.20
      nat (insideold,outsideold) static obj-x.x.x.10-20
    From some debugging and looking at packet-tracer, I found out I left out the below which was needed to properly nat traffic as it leaves the outside interface (when the default sends the traffic)
    object network obj-192.168.x.10-20-2
      range 192.168.x.10 192.168.x.20
      nat (insideold,outside) static obj-x.x.x.10-20
    There are / were a bunch of other nat exemptions for the VPNs and specific external routes to ensure all vpn traffic exited the "outsideold" interface which is where all the existing tunnels were terminated.
    Everything appeared to be working great as all the VPN tunnels came up perfectly as expected and traffic appeared to be flowing, except for some of the most important traffic.  The following was what was observed:
    1.  Any traffic using the dynamic NAT (ie...a machine with IP x.x.x.200 or y.y.y.20) would connect to the internet perfectly and work fine using the "new interface ip".
    2.  Any traffic in the "new range" using a one to one nat worked perfectly (ie y.y.y.140).  Internet would work etc and nat translation would properly occur and everything could connect fine as expected.
    3.  ICMP packets to "old ip range" flowed perfectly fine to one to one nat IP (ie I could ping x.x.x.20 from outside) and likelise I could ping anywhere on the internet from a machine with a static natted ip.
    4.  Heres the butt...no traffic other than ICMP would reach these machines with static ips.  Same range, same subnet as ones using the dynamic port translation that worked perfectly.  Do not understand why this was / is the case and this is what I am seeking a solution to.  I have attempted the following troubleshooting steps without success:
    A. Confirmed MTU size was not an issue with the GRE tunnel.  2 methods, one plugging to edge router and using the "outsideold" ip space works perfectly and 2 if I assign outsideold ip space to "outside" interface, everything nats fine.
    B. Ran packet-tracer, all results show "allow" as if I should be seeing the packets.
    C. Confirmed local windows machine firewall was off and not blocking anything.
    D. Reviewed logs and observed SYN timeouts and TCP teardowns as if the firewall is not getting a response and this is where I am stumped.  There is no path around the firewall so asymmetric routing should not be an issue and if that was the problem it should not work when the "outsideold" ip space is assigned and natted from the "outside" interface, but it does.  Packet-tracer shows proper nat translations occurring and there is definitely proper routing along the path for stuff to return to the network or ICMP would not work (IE I can ping www.google.com but not open the web page).
    So what simple piece of the nat configuration am I overlooking because I cannot possible wrap my head around it being anything else.
    Any suggestions / lessons would be greatly appreciated.

    is this still a problem?

  • Dynamic PAT and Static NAT issue ASA 5515

    Hi All,
    Recently we migrated our network to ASA 5515, since we had configured nat pool overload on our existing router the users are able to translated their ip's outside. Right now my issue was when I use the existing NAT configured to our router into firewall, it seems that the translation was not successful actually I used Dynamic NAT. When I use the Dynamic PAT(Hide) all users are able to translated to the said public IP's. I know that PAT is Port address translation but when I use static nat for specific server. The Static NAT was not able to translated. Can anyone explain if there's any conflict whit PAT to Static NAT? I appriciate their response. Thanks!
    - Bhal

    Hi,
    I would have to guess that you Dynamic PAT was perhaps configured as a Section 1 rule and Static NAT configured as Section 2 rule which would mean that the Dynamic PAT rule would always override the Static NAT for the said host.
    The very basic configured for Static NAT and Default PAT I would do in the following way
    object network STATIC
    host
    nat (inside,outside) static dns
    object-group network DEFAULT-PAT-SOURCE
    network-object
    nat (inside,outside) after-auto source dynamic DEFAULT-PAT-SOURCE interface
    The Static NAT would be configured as Network Object NAT (Section 2) and the Default PAT would be configured with Twice NAT / Manual NAT (after-auto specifies it as Section 3 rule)
    This might sound confusing. Though it would be easier to say what the problem is if we saw the actual NAT configuration. Though I gave the reason that I think is probably one of the most likely reasons if there is some conflict with the 2 NAT rules
    You can also check out a NAT document I made regarding the new NAT configuration format and its operation.
    https://supportforums.cisco.com/docs/DOC-31116
    Hope this helps
    - Jouni

  • Best way to pass IPv4 and IPv6 traffic over a GRE Tunnel

    Hello,
    We have two 3825 routers with Advanced Enterprise IOS 12.4.9(T). Each of them serves many IPv4 (private and public) and IPv6 networks on their respective site.
    We have created a wireless link between the two, using 4 wireless devices, with IP Addresses 10.10.2.2, 3, 4, 5 respectively (1 and 6 are the two end Ethernet interfaces on the routers).
    Then we created a GRE tunnel over this link using addresses 172.16.1.1 and 2 (for the two ends) to route traffic over this link.
    Now we want to route IPv6 traffic over the same link. However, we found that simply routing the IPv6 traffic over the above GRE / IP tunnel did not work.
    Questions:
    Is there a way we can use the same (GRE / IP) tunnel to transport both IPv4 and IPv6 traffic?
    If not, can we setup two GRE tunnels over the same wireless link, that is, one GRE / IP for IPv4 traffic and a second one GRE / IPv6 for IPv6 traffic?
    In brief, what is the suggested way to transport IPv4 and IPv6 traffic over the aforementioned (wireless) link?
    I have read http://www.cisco.com/c/en/us/td/docs/ios/12_4/interface/configuration/guide/inb_tun.html#wp1061361 and other Internet material, however I am still confused.
    Please help.
    Thanks in advance,
    Nick

    We have set up two tunnels over the same link, one GRE / IP for the IPv4 traffic and one IPv6 / IP ("manual") for the IPv6 traffic. This setup seems to be working OK.
    If there are other suggestions, please advise.
    Thanks,
    Nick

  • QOS - GRE Tunnel, Crypto and Marking within the cloud.

    Hi,
    We have the following scenario -
    |--R1---Z---R2---(cloud)---R3---Z---R4---|
    |-----------GRE Tunnel----------|
    Z are external cryptos, we have a GRE tunnel between R1 and R4 (the lines don't line up!!). Traffic passes through the tunnel fine.
    We have found that traffic received on R1 ingress with a DSCP has that DSCP maintained through the tunnel, we can also re-mark that traffic on R1 ingress successfully.
    The problem is we can't re-mark with a different DSCP when it traverses R2 and R3 (we guess it's because the traffic is encrypted and tunnelled), which are 7507's. We expected to be able to remark the tunnel traffic.
    A couple of questions -
    1. Should we be able to Re-mark the traffic? For some reason it won't match our class-maps.
    2. Is a GRE tunnel the best solution for this?
    Thanks.
    Mat.

    Thanks for the reply. We rebooted the router this morning and it kicked into life!!
    A couple of thoughts about your idea, firstly the tunnel was from R1, my interpretation of that command is that it should go on the endpoints of the tunnel? Also the command isn't available on the 7500's.
    Thanks again,

  • GRE tunnel MTU and bandwidth

                       Hi Everyone.
    GRE tunnel from Site A has
    MTU 17916 bytes, BW 100 Kbit, DLY 50000 usec,
    Site B has
    MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,
    I read that default BW for GRE is 9kbit  but here 1 side has default and other side has 100.
    One side has default MTU other side has 17916
    so is this normal behaviour?
    So need to know the purpose of using MTU 17916 and bandwidth of 100  on Site A?
    Thanks
    Mahesh

    Hello Mahesh,
    The bandwidth and Delay on the Tunnel interface is sometimes used to change the EIGRP metrics to influence routing table. For example if you have two equal cost paths to certain network in your routing table, you can increase the delay on one of the tunnels and make the other tunnel the preffered one. Not sure if this is the case with your setup.. it;s really hard to say without looking at the config.
    As for the MTU, not sure why MTU size is 17916..  1514 make sense but still too big for a GRE tunnel.. I think
    Please rate this post if helpful.. THanks

  • Overlapping Networks with Tunnel GRE/IPsec and NAT

    Has anyone experience with NATing on a GRE tunnel interface? I need to NAT between two private networks because they are overlapping. I tried to NAT directly on the tunnel interface.
    e.g.
    Ethernet 0/0
    ip nat inside
    Tunnel0 (GRE with CryptoMap)
    ip nat outside
    However I didn't succeed this way. What's the best way to achive my goal?

    Thanks. I already checked this paper. The problem is that it only talks about IPsec and not about GRE/Ipsec and nating on a Tunnel interface.
    However I made some tests in the lab and it worked fine. So I went back to the customer-site and I had to reboot the small 836 to get it working.
    What I learnedis : "ip nat outside" on a tunnel interface on a Cisco 836 is no problem. This is good news if you have to add partners companies with GRE/IPsec and they don't have IP ranges you like, so you just NAT them and give them IP addresses of your choice.

Maybe you are looking for

  • When will Adobe Reader for iOS support Livecycle XFA forms?

    Adobe Reader for iOS currently does not appear to support XFA forms created through Livecycle. Although it supports some field types, the HTTP submit and Email submit buttons don't work. Being able to email the completed form ready for someone else t

  • Car Signal Booster

    I work on a construction sites all around Indiana. Well most of these sites do not have very good signal... Or you walk to one spot and it goes up to 2 or 1 bar then the next is no signal... Everyday for lunch we sit in truck and txt/surf internet/ma

  • Meaningful names for report attachments in BIP.

    Hi, I am emailing/ftp'ing few reports from BI Publisher. The report attachments are going out as attchment.xls, attachment.out, attachment.pdf etc. I wouldl like to name these attachements with a meaningful name. Example if Accounts is my report I wo

  • Executing unix command / which user ?

    Hi, I'm trying to execute a mv command to rename a file before loading it. Full permission is given to file (chmod 777). I used an external process by writing the full command in COMMAND parameter. OWF does not perform the task with the following mes

  • Silverlight stopped working - Say something... am giving up!

    If cannot resolve this issue, I will stay away from implementing Silverlight on our web site. https://social.msdn.microsoft.com/Forums/silverlight/en-US/newthread?category=silverlight&forum=silverlightstart - Latest updates as of Dec 26th, 2014 - WIN