Community discussions

MikroTik App
 
porli
just joined
Topic Author
Posts: 5
Joined: Mon Jun 22, 2015 2:00 pm

IPsec Site 2 Site not working

Mon Jun 22, 2015 2:11 pm

Hey,
fist of all, i want to say, that i'm very new to this, so please be patient, if i don't understand so quick.

I just want to establish a site 2 site ipsec connection between 2 places, but i didn't get it to work good.

There must be a small mistake anywhere, but i didn't find it, and time is running out, so i please need your help.
I looked at every tutorial i can find, but everything should be ok.

Place 1:
ext. ip: 178.189.59.xx
int. ip: 192.168.20.0/24

Place2:
ext. ip: 84.115.29.xx
int. ip: 192.168.10.0/24

Phase one, is working, on both sides are the correct remote peer in list.
But there are no SAs Keys in the list, so maybe the connection is not established right?
Passphrase is correct on both. Also Policy is correct on both. Proposal is same.

NAT:
Place 1: srcnat, Src: 192.168.20.0/24, Dest: 192.168.100.0/24, accept, on top of list.
Place 2: vice versa

I'm not able to ping the other side, in any direction. Public ips are pinkable from both sides.
 
IntrusDave
Forum Guru
Forum Guru
Posts: 1286
Joined: Fri May 09, 2014 4:36 am
Location: Rancho Cucamonga, CA

Re: IPsec Site 2 Site not working

Tue Jun 23, 2015 10:32 am

My first thought is adding the routing.
/ip route
add distance=1 dst-address=192.168.10.0/24 gateway=ether1
Second thought is firewall rules.
/ip firewall filter
add add chain=forward src-address=192.168.10.0/24
Last thought is to enable IPSec logging to see what's going on. But, if you have Phase 1 up, and you are sure that your policies are correct, then it's likely just filter and route issues. If you post your IPSec export, we can help more.
 
Nova
newbie
Posts: 25
Joined: Mon Aug 04, 2014 3:44 pm
Location: Spain // Germany

Re: IPsec Site 2 Site not working

Wed Jun 24, 2015 1:28 pm

I guess this is a mistake from you writting it here, check the router just in case:
NAT: Place 1: srcnat, Src: 192.168.20.0/24, Dest: 192.168.100.0/24, accept, on top of list.

also in firewall I have added this rules:
/ip firewall filter
add chain=input action=accept protocol=ipsec-esp 
IPSEC - IKE
/ip firewall filter
add chain=input action=accept protocol=udp in-interface=pppoe-out1 dst-port=500 
and in your case I would add this one:
/ip firewall filter
add chain=forward action=accept src-address=192.168.20.0/24 dst-address=192.168.10.0/24 
in both routers, change the source address
also try to ping the remote lan through your Lan Interface