- Remove all the special measures you have taken from the MikroTik.Is there something I am not taking into account here for ipsec to work through the Mikrotik?
I have been trying to get GRE over IPsec transport work over NAT-T and have not been successful.Not really, L2TP/Ipsec is transport mode and works with no problems over NAT.NAT-T only works with IPsec tunnel mode and using ESP. No transport mode, no AH.
I am not using mikrotik asa a vpn gw because its purpose is to be a backup gateway for the Cisco router. All ipsec configuration is on the Cisco router. Also I do not have access to Cisco router. Config is done by a client and they want to use their own router.PEER IPSEC >> INTERNET >> MIKROTIK >> CISCO
CMIIW, you need to create an ipsec connection using cisco device? why dont you use mikrotik as an ipsec vpn gateway?
if you want to use cisco as your VPN Gateway, you need to allow UDP connection 500, 4500, ipsec-esp, passthrough mikrotik firewall, and make sure cisco route via mikrotik.
I have tried to run GRE over an nated connection(one end) and it worked.I have been trying to get GRE over IPsec transport work over NAT-T and have not been successful.Not really, L2TP/Ipsec is transport mode and works with no problems over NAT.NAT-T only works with IPsec tunnel mode and using ESP. No transport mode, no AH.
GRE over IPsec transport works OK without NAT both with ESP and with AH, and also IPsec/ESP tunnel over
NAT-T works OK. IPsec/AH tunnel does not work over NAT-T.
Do you think it is possible to do GRE over IPsec/ESP transport over NAT-T?
If so, how to configure it in GRE Tunnel, IPsec Policy and IPsec Peer?
I have finally found what confused me with IPsec in combination with NAT.No, I did GRE IPsec in transport mode(default mode) and it worked with the issue I mentioned.
ESP is used to encapsulate traffic in both tunnel and transport mode. RFC3948 ("UDP Encapsulation of IPsec ESP Packets") covers both tunnel and transport mode, and so NAT-T should work equally good for both tunnel and transport mode IPsec.The issue is this: GRE or IPIP or L2TP over IPsec in transport mode can work over NAT, but it will NOT use the NAT-T
protocol in that case. Only IPsec with ESP in tunnel mode uses NAT-T.