i am quite new to mikrotik networking so please forgive me beforehand.
i am trying to setup a basic gre tunnel between cisco isr4300 and a 951ui-2hnd routers. on cisco side everything seems to be set ok; including: tunnel state is reported up/up, wan interface ip is set, lan interface ip is set ... here is the ip plan:
cisco:
wan ip: 1.1.1.2/30
lan ip: 192.168.253.1/30
tunnel ip: 10.10.10.1/30
routing report:
10.10.10.0/30 is directly connected, Tunnel0
10.10.10.1/32 is directly connected, Tunnel0
...
172.16.0.0/24 is subnetted, 2 subnets
172.16.1.0 [1/0] via 10.10.10.2
172.16.2.0 [1/0] via 10.10.10.2
on mikrotik side, i've uploaded the config file to see where i've gone wrong or missing:
Code: Select all
# jan/02/1970 00:59:17 by RouterOS 6.44.5
# software id = 0G7Y-54W3
#
# model = 951Ui-2HnD
# serial number = B8570BE4F3C7
/interface bridge
add admin-mac=C4:AD:34:82:55:8B auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1_WAN
set [ find default-name=ether2 ] name=ether2_LAN
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=\
MikroTik-82558F wireless-protocol=802.11
/interface gre
add local-address=2.2.2.2 name=tunnel0 remote-address=1.1.1.2
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/interface bridge port
add bridge=bridge comment=defconf interface=ether2_LAN
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1_WAN list=WAN
/ip address
add address=2.2.2.2/30 interface=ether1_WAN network=2.2.2.0
add address=172.16.2.1/24 interface=ether2_LAN network=172.16.2.0
add address=10.10.10.2/30 interface=tunnel0 network=10.10.10.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\
ether1_WAN
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \
protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid disabled=yes
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new disabled=yes in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes \
ipsec-policy=out,none out-interface-list=WAN
add action=accept chain=srcnat dst-address=192.168.253.0/24 src-address=\
172.16.2.0/24
add action=masquerade chain=srcnat disabled=yes out-interface=ether1_WAN
/ip route
add distance=1 dst-address=192.168.253.0/24 gateway=10.10.10.1
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
kind regards.