Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 1 subscriber
  • Views 16223 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ASTARO to CISCO GRE tunnel

mircevski
Hi,

I'm trying to build a vpn tunnel ASTARO to CISCO. I did the following:

ASTARO side:
iptunnel add tun0 mode gre remote xx.xx.xx.xx  local yy.yy.yy.yy ttl 255
ifconfig tun0 inet 172.16.8.2 netmask 255.255.255.0
ifconfig tun0 up

CISCO side:
interface Tunnel0
 ip address 172.16.8.1 255.255.255.0
 tunnel source xx.xx.xx.xx
 tunnel destination yy.yy.yy.yy

It should be as simple as this, but it doesn't work.

Has anyone done this?

Thanks


This thread was automatically locked due to age.
  • 0
    Hi, mircevski, and welcome to the User BB!

    Is there a reason you don't do the Astaro side in WebAdmin?  I guess you could look in the Firewall Live Log to see which packets are being blocked.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    Well, I don't use the webadmin, because there is no option for a GRE tunnel. Or, at least, I didn't found it. I only found SSL and IPSEC tunneling options. Is there a GRE option?

    Thanks
  • 0
    Hi,

    I don't know of a GRE option, but I do know that IPSEC VPNs work with Cisco VPN concentrators (e.g. 3030), and with ASA's (e.g. 5510).

    Barry
  • 0
    AH, GRE - I didn't even see that.  I wonder if you could use the "DSL (PPPOA/PPTP)" Interface type to accomplish what you want.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    I'll try with pppoa/pptp option
  • 0
    nope, not working

    Any other idea? I'm perfectly happy if someone would correct the cli solution that I presented above.

    Thanks
  • 0
    Your CLI command works for we connection to ASGs with GRE.

    Do you setup packetfilter rules on ASG, allowing protocol 47?
    You must create two rules, one with Interface Address object as Source
    and one with Interface Address object as Destination. This will create the necessary USR_INPUT and USR_OUTPUT rules. Otherwise the rules are put in USR_FORWARD if you choose ANY or a custom created network definition.
Unfiltered HTML