Community discussions

MikroTik App
 
passarelli
just joined
Topic Author
Posts: 14
Joined: Wed Mar 15, 2017 10:03 pm

IPsec tunnel doesn't reestablish

Tue Apr 10, 2018 3:53 pm

Hello everyone,
I have 3 ipsec tunnels configured, all of them was working properly until my internet link failed, 10 days ago.
When the internet link has came back 2 tunnels were reestablished and are working properly, but one didn't.
I've flush installed SAs and killed Peers connections, but didn't work.
Is there something else I could do?
Regards,
 
User avatar
sindy
Forum Guru
Forum Guru
Posts: 11317
Joined: Mon Dec 04, 2017 9:19 pm

Re: IPsec tunnel doesn't reestablish

Tue Apr 10, 2018 6:00 pm

Is there something else I could do?
Regards,
You can set the logging to log all ipsec related messages (to memory!) at both ends and read the result to find out what is actually going on.
 
tippenring
Member
Member
Posts: 304
Joined: Thu Oct 02, 2014 8:54 pm
Location: St Louis MO
Contact:

Re: IPsec tunnel doesn't reestablish

Tue Apr 10, 2018 6:02 pm

/system logging
add disabled=no prefix="IPSEC: " topics=ipsec,!packet
 
passarelli
just joined
Topic Author
Posts: 14
Joined: Wed Mar 15, 2017 10:03 pm

Re: IPsec tunnel doesn't reestablish  [SOLVED]

Mon Jun 11, 2018 9:40 pm

Hello, sorry for delayed reply.
It is working properly now, I've entered in contact with mikrotik support and they said I was missing src-nat rule below.
/ip firewall nat add chain=srcnat action=accept src-address=Local-Public-Address dst-address=Remote-Public-Address place-before=0
Thanks for all replies.
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 2098
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Krugersdorp (Home town of Brad Binder)
Contact:

Re: IPsec tunnel doesn't reestablish

Tue Jun 12, 2018 2:01 am

Hello, sorry for delayed reply.
It is working properly now, I've entered in contact with mikrotik support and they said I was missing src-nat rule below.
/ip firewall nat add chain=srcnat action=accept src-address=Local-Public-Address dst-address=Remote-Public-Address place-before=0
Thanks for all replies.

I am not sure how it was then possible for these tunnels to work before?

Also, the src at rule should be internal LAN IP's and not external public IP's