CloudLabBox
Try the free demo

MikroTik MTCNA lab 14 of 19

Tunnels: IPIP, GRE and EoIP

Join two sites across the Internet three ways: an IPIP tunnel and a GRE tunnel with keepalive carrying routed traffic (with automatic fail-over between them), and an EoIP tunnel that stretches the head-office LAN to a shop at layer 2, encrypted with IPsec.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 3,840 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCNA RouterOS v7 guided labs, then 14 - Tunnels - IPIP GRE and EoIP

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
6 vCPU, 3,840 MB
Smallest plan
Lite

The scenario

A bakery chain has head office (HQ) and a new Shop, each with ordinary broadband from different exchanges. The shop's PCs need to reach the HQ LAN, and the shop Till must sit on the HQ LAN itself (192.168.1.0/24), because the stock system only talks to devices on its own subnet. There is no NAT between the sites today: both routers have public addresses.

DeviceInterfaceAddress
HQether1 (WAN) · bridge-lan (ether2)203.0.113.2/30 · 192.168.1.1/24
Shopether1 (WAN) · ether2 (LAN) · ether3198.51.100.2/30 · 192.168.2.1/24 · Till port (layer 2 only)
TunnelsIPIP · GRE172.16.1.1/30 – .2 · 172.16.2.1/30 – .2 (HQ .1, Shop .2)
EoIPtunnel ID 10no addresses: bridged into HQ's LAN
PC-HQ · PC-Shop · Tilleth0192.168.1.10 · 192.168.2.10 · 192.168.1.30 (gateway 192.168.1.1)

What you’ll practise

  • Explain layer-3 tunnels (IPIP, GRE) and layer-2 tunnels (EoIP), and their overheads
  • Build IPIP and GRE tunnels and route LANs through them
  • Use GRE keepalive and route distance for automatic fail-over
  • Bridge an EoIP tunnel to extend a LAN to another site
  • Encrypt a tunnel with ipsec-secret and check the IPsec peers

The tasks

  1. Check the path the tunnels will use
  2. Build an IPIP tunnel
  3. Build a GRE tunnel with keepalive
  4. Route the LANs through the tunnels, GRE first
  5. Test the fail-over
  6. Stretch the HQ LAN to the shop with EoIP
  7. Encrypt the EoIP tunnel

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Tunnels - IPIP GRE and EoIP6 nodes, 5 links. Every link is listed as text below the diagram.ISPHQShopPC-HQPC-ShopTillether2eth0ether2eth0ether3eth0ether1ether1ether2ether1
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP ether1 to HQ ether1
  • ISP ether2 to Shop ether1
  • HQ ether2 to PC-HQ eth0
  • Shop ether2 to PC-Shop eth0
  • Shop ether3 to Till eth0
Nodes in Tunnels: IPIP, GRE and EoIP, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
HQMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
ShopMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
PC-HQVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC-ShopVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
TillVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCNA RouterOS v7 guided labs.

  3. Open 14 - Tunnels - IPIP GRE and EoIP and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCNA labs

All MikroTik MTCNA labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.