Sun Oct 03, 2021 5:22 pm
There are two (or even more) independent packet streams in IPsec - the "control session" (the IKE SA) and the "session(s) transporting the payload" (the data SA(s)). If there is a NAT somewhere between the peers, all the SAs use the same UDP stream; if there is not, the data SAs use ESP protocol, so you may need to permit ESP in the input chains of the firewalls - I hope they are not empty despite what your abstract from the configuration suggests. The ESP packets are only sent if there is a payload packet to be transported, so until each side sends at least one payload packet, it won't accept any ESP packet coming in without a permissive rule, so you get the chicken-and-egg problem. So try pinging a destination in the pfSense LAN from the Mikrotik LAN, and at the same time ping a destination in the Mikrotik LAN from the pfSense. If it starts working, the missing rules are the reason.
Regardless this, what does the PH2-TOTAL column in /ip ipsec active-peers print show? If 0, the "tunnel" is actually not up because the data SA(s) could not be established for some reason.