Hello,
i decided to upgrade an old Linksys/Cisco router and i now a have Mikrotik
Problem is that i had a VPN Gateway to Gatwey with another Lynksys router, i setup the Mikrotik but it doesn't pass phase 2 of authentification it conects phase 1 for 30s but that's it.
The Linksys router config:
Local security: Ip only
Remote security: Ip only
Keying Mode: Ike with preshared key
Phase1 DH Group: Group 1
Phase1 Encryption: 3DES
Phase1 Authentication: SHA1
Phase1 SA Life Time: 28800 seconds
Perfect Forward Secrecy: Yes

Phase2 DH Group: Group 1
Phase2 SA Life Time: 3600 seconds
Preshared key: secret

and on the Mikrotik i have this config: i feel like i'm missing something here, but still can't make-it work.
Thank you for all the help.

You should see the answer in the log. Use /system logging add topics=ipsec,!packet to enable detailed logging of IPsec. Then, disable the peer at Tik side, let it "cool down" for 5 minutes, then run /log print follow-only file=ipsec-startup where topics~"ipsec" and re-enable the peer. Once phase 1 comes up and phase 2 fails, break the /log print ... command, download the file and read it.

If you cannot find the reason on your own, post the file here, after anonymizing it the way suggested in my automatic signature right below.

Also, you may want to upgrade the machine from 6.43.16 to 6.44.6 (long-term) if not 6.45.7 (stable). I don't suggest that the old RouterOS version is the reason why phase 2 fails, but the structure of the IPsec configuration has changed between 6.43 and 6.44, so once you are starting with IPsec on Tik anyway, maybe better to learn the new way already now.

Upgrade the machine, this should solve your issue I think.

Hello, and thank you, i updated the router and bellow is the log for ipsec.

The only thing that pop-up was: 16:43:48 ipsec no IKEv1 peer config for 25.2.198.15

Hm. In the IKE session where Mikrotik acts as initiator, it sends the Phase 2 negotiation packet multiple times and the remote peer doesn't respond to it at all: then 16:43:30, then 16:43:40.

At 16:43:48, an incoming attempt from the remote peer is received but it seems not to be accepted, so I guess the configuration conversion from 6.43.16 to 6.45.7 didn't go completely well. Please show me the current /export verbose hide-sensitive.

Hello,
thank you very much. Bellow is the export. Sorry for the late response

These two things fo not match each other to me, except if Cisco uses other exchange mode than main and the log message is confusing:
vs.
So to obtain some additional information, I'd recommend to set passive=yes on the Mikrotik peer, so that we could see the Phase 2 proposal coming from the Cisco while it acts as an initiator, and if you keep seeing "no IKEv1 peer config for 25.2.198.15" message, try to set that peer's exchange-mode to aggressive and base one-by-one.

The Cisco obviously did respond to our initial message, so exchange mode main is not a show stopper on its own, but as we want to see the Cisco's phase 2 proposal, we need to accommodate to its initial request.

Hello, thank you, i didn't changed the peer as you suggested, but it give me an idea, I changed on the Linksys (actually i disabled) Aggressive mode and now the VPN work's.
The rest off the config is the same.
I don't understand how come this mattered so much.
In the old config (with Cisco/Linksys) i used Aggressive mode for DEAD peer.