In case of gre over ipsec what ipsec policy should I create? Does it need to be a 255(all) or 4(ip-encap) or 47 gre? I am configuring it between huawei and mikrotik. Huawei guide suggests to set up for ipsec acl for gre over ipsec.
Definitely not IP-ENCAP as GRE is a different protocol. Setting GRE is sufficient if Huawei supports that too, otherwise 255. The Huawei ACL 3000 in your other topic as linked by @msatter doesn’t specify any IP protocol, hence 255 (which is the default if you don’t specify any protocol) at Mikrotik side is a matching setting.
Definitely not > IP-ENCAP > as > GRE > is a different protocol. Setting > GRE > is sufficient if Huawei supports that too, otherwise 255. The Huawei ACL 3000 in your other topic as linked by @msatter doesn’t specify any IP protocol, hence 255 (which is the default if you don’t specify any protocol) at Mikrotik side is a matching setting.
Yes as per that guide from huawei the acl mentions:
acl number 3000 //Configure an ACL.
rule 0 permit ip source 1.2.1.1 0 destination 1.2.2.1 0
so when I set this acl to gre after permit instead of ip tunnel establishes but no traffic passes even though the tunnel is established.
Let me try with 255 on mikrotik end.
Of course you can do whatever you need to keep the other end happy. In MikroTik you can auto-create a policy (by just entering an IPsec key directly at the GRE interface settings) and it will automatically create the policy, and you can look at it.
I found out that with 3DES and SHA1 and 255 tunnel establishes and traffic moves through it. Having issue with other cipher combinations. tunnel between huawei and mikrotik.
That is quite common with incomplete or older IPsec implementations.
It is also the reason why this is still the default configuration. When you change it, you run the risk of problems.
make your life easily, play specially with ipsec with same vendors devices.
I had unestablished tunnels with mikrotik on different version.
When i upgraded to later version bum everything works well.
i found dynamic routhing protocol are much more easy (i’m avoiding as much as possible) for establishing..ipsec is just weasting a time
I am using GRE over IPSec, so that I can use ospf between branches.
It should work well.
Another potential problem is to enable keepalive. Don’t do that at first. It can be incompatible.
With a routing protocol on top you probably don’t require the keepalive at all. When you want fast switchover use BFD instead.
I am using GRE over IPSec, so that I can use ospf between branches.