GRE over IPsec, ASA and NAT-T

[boban-petrovic]

I want to establish GRE over IPsec tunnel between four branch offices and head office. At branch offices, I have 1841 router with Advanced Security software. At head office, I have a ASA5510 7.2 as frontend with one public IP addres and 1841 router behind it in private address space. Since ASA is not supporting GRE tunnels, can ASA be endpoint for GRE over IPsec? If not, can ASA pass this tunnel to the 1841 router behind it, so 1841 would be logical tunnel endpoint? What should I pay attention? Should both ASA and every 1841 support NAT-T, or just ASA?

[andrew.prince · Accepted solution]

The ASA does not support GRE.

The router would be the GRE tunnel end point.  The ASA would be the endpoint for the IPSEC VPN.  NAT-T should not be a concern, if the ASA and the remote routers are directy connected to the internet.

HTH.