topic Re: GRE over IPSEC in General Topics

GRE over IPSEC

Rafal_Oracz — Tue, 27 Aug 2024 13:57:47 GMT

Hi,

Has anyone managed to build GRE through an IPSEC tunnel?

I tried both: domain and route based IPSEC.

All I can achive is GRE traffic seen within vpnt interface, but it seems to blackhole traffic since I cant see any IPSEC traffic going out the gateway.

If it is possible, I prefer domain based IPSEC but it seems that gateway has problem with redirecting its own GRE traffic to IPSEC tunnel.

Re: GRE over IPSEC

the_rock — Tue, 27 Aug 2024 18:33:53 GMT

Last time I got it working was back in R76, have not tried it after that. Not sure if things changed drastically since then when it comes to GRE, but what is the drop if you see any? Is there specific log?

Its 100% supported, so I would certainly check things I mentioned.

Andy

https://community.checkpoint.com/t5/Security-Gateways/GRE-Tunnel/td-p/64838

Re: GRE over IPSEC

Lesley — Tue, 27 Aug 2024 20:37:23 GMT

https://support.checkpoint.com/results/sk/sk90060

Re: GRE over IPSEC

CheckPointerXL — Wed, 11 Sep 2024 09:37:52 GMT

i had to configure a new FW, one to perform GRE, the other one IPSEC

spent lot of weeks but it seems not possible with one FW to perform both operations

Re: GRE over IPSEC

PhoneBoy — Wed, 11 Sep 2024 12:55:43 GMT

It should be noted that GRE traffic, especially originating from the gateway itself, is not SecureXL friendly.
It will always go slowpath/F2F.

Re: GRE over IPSEC

Chris_Atkinson — Wed, 11 Sep 2024 15:09:48 GMT

Why would you want GRE+IPSec if you have native route based VPN, is it some use case involving multicast?

Re: GRE over IPSEC

Rafal_Oracz — Wed, 18 Sep 2024 07:55:03 GMT

Thanks all of you for answers.

Suddenly it started to work when I tried to swtich to route based VPN, but finnaly it works on default domain based VPN.
This configuration is needed to connect to mobile Private APN.