GRE NAT through ASA

[tachyon05]

For certain traffic, I need to build a GRE tunnel sourced from a router behind my ASA to a remote vendor.  My office only has 1 public IP, and it is on the ASA outside interface.  Do I need to have a second public IP, dedicated to GRE, on my ASA?  Or can GRE work off the existing public IP used for everything today?

[Richard Burts]

If you had a second public IP it would simplify things. But I do not think it is required. You should be able to do a static address translation on the ASA that is specific to GRE. You should know the source address of the packet (your router interface address), the destination address (the vendor device address) and the protocol (GRE is IP protocol 47). So if the ASA receives an IP packet on its inside interface with the specified source address, specified destination address, and GRE protocol then the ASA translates the source address using its public IP. And if the ASA receives an IP packet on its outside interface whose source address is the vendor address, destination address is the ASA public IP, and GRE protocol then the ASA translates the destination address to be your router interface address. 

[tachyon05]

What you describe makes sense.  However, when I tried that, I get an error message - "Translated Source Address overlaps with the IP address for the interface outside."

[Richard Burts]

Instead of putting the IP address of the interface into the translation statement try using the word interface.

[tachyon05]

Thanks Richard.  I setup this in a lab but I can't seem to get the correct command.  Any suggestions?

I have these objects

object network gre-source-private
host 192.168.2.2
object network gre-source-public
host 10.200.30.

object service ip-protocol-gre
service gre

When I issue this command

nat (guest,outside) source static gre-source-private interface service ip-protocol-gre ip-protocol-gre

I get >> ERROR: real service object includes protocol that doesnt match SCTP, TCP or UDP.

[fcardoso]

I Richard,

Regarding the static address translation on ASA, It is normal practice to open port´s inbound so the GRE tunnel could be established? it is considered secure? I have search for a designed guide or best practices when we need to do NAT on ASA to build a IPsec or Gre tunnel, but i did not find anything....

Best Regards

Fernando