Community discussions

MikroTik App
 
Mrdude
just joined
Topic Author
Posts: 24
Joined: Thu Mar 01, 2018 3:07 pm

IPsec tunnel established but no traffic.

Sun Oct 03, 2021 4:48 pm

Good day.
I am using an intersite IPsec tunnel between ROS, after configuration it worked flawlessly.
But! After moving router to a new site, traffic in both directions stopped going through the tunnel, Mikrotik shows 0 packets.
At the same time, the tunnel itself works stably.
Please help with identifying the cause of this malfunction.
Last edited by Mrdude on Sat Oct 09, 2021 9:16 pm, edited 1 time in total.
 
User avatar
sindy
Forum Guru
Forum Guru
Posts: 11145
Joined: Mon Dec 04, 2017 9:19 pm

Re: IPsec tunnel established but no traffic.  [SOLVED]

Sun Oct 03, 2021 5:22 pm

There are two (or even more) independent packet streams in IPsec - the "control session" (the IKE SA) and the "session(s) transporting the payload" (the data SA(s)). If there is a NAT somewhere between the peers, all the SAs use the same UDP stream; if there is not, the data SAs use ESP protocol, so you may need to permit ESP in the input chains of the firewalls - I hope they are not empty despite what your abstract from the configuration suggests. The ESP packets are only sent if there is a payload packet to be transported, so until each side sends at least one payload packet, it won't accept any ESP packet coming in without a permissive rule, so you get the chicken-and-egg problem. So try pinging a destination in the pfSense LAN from the Mikrotik LAN, and at the same time ping a destination in the Mikrotik LAN from the pfSense. If it starts working, the missing rules are the reason.

Regardless this, what does the PH2-TOTAL column in /ip ipsec active-peers print show? If 0, the "tunnel" is actually not up because the data SA(s) could not be established for some reason.

Who is online

Users browsing this forum: cyb2, mada3k and 58 guests