IPSec Identity Address

[Daniel Smith]

I have built a lab set up to test an encrypted GRE tunnel between my company and another. At our side, the router is in a DMZ, and the IP address (10.97.230.245) gets translated into a public IP as it hits the Internet. When I apply the IPSEC configuration, the tunnel breaks. Digging in to the issue, I see on the far end router, that the IP address associated with the IPSEC peering is still the 10.97.230.245, instead of its translated value. Is there something I need to do at the near end router (my side) so that it uses its' translated IP for the IPSEC session?

[Marcin Latosiewicz]

IKE doesn't require that IP address in the header to be equal ISAKMP identity.

Check if you have NAT-T enabled first of all. Than check where it breaks - check isakmp and ipsec debugs (both sides).

[Daniel Smith]

After tweaking around a bit, I was not able to precisely re-create this situation. However, when I changed to IPSEC transport mode, all is now working.