IPsec tunnel established but no traffic.
Posted: Sun Oct 03, 2021 4:48 pm
by Mrdude
Good day.
I am using an intersite IPsec tunnel between ROS, after configuration it worked flawlessly.
But! After moving router to a new site, traffic in both directions stopped going through the tunnel, Mikrotik shows 0 packets.
At the same time, the tunnel itself works stably.
Please help with identifying the cause of this malfunction.
Re: IPsec tunnel established but no traffic. [SOLVED]
Posted: Sun Oct 03, 2021 5:22 pm
by sindy
There are two (or even more) independent packet streams in IPsec - the "control session" (the IKE SA) and the "session(s) transporting the payload" (the data SA(s)). If there is a NAT somewhere between the peers, all the SAs use the same UDP stream; if there is not, the data SAs use ESP protocol, so you may need to permit ESP in the input chains of the firewalls - I hope they are not empty despite what your abstract from the configuration suggests. The ESP packets are only sent if there is a payload packet to be transported, so until each side sends at least one payload packet, it won't accept any ESP packet coming in without a permissive rule, so you get the chicken-and-egg problem. So try pinging a destination in the pfSense LAN from the Mikrotik LAN, and at the same time ping a destination in the Mikrotik LAN from the pfSense. If it starts working, the missing rules are the reason.
Regardless this, what does the PH2-TOTAL column in /ip ipsec active-peers print show? If 0, the "tunnel" is actually not up because the data SA(s) could not be established for some reason.