IPSec VPN when remote network is 0.0.0.0
Posted: Mon Aug 27, 2012 9:58 am
Hi All,
I am evaluating a RB411-3G as a possible replacement for a combination of Cisco router + external 3G modem for some remote locations. The router has to build an IPSec VPN connection to a central Cisco ASA and tunnel everything through, that is corporate traffic and internet access. In Cisco world, this is a normal Remote Access VPN connection where the local network is something like 10.106.200.0/24 and the remote network (i.e. on the ASA side) is "any", i.e. 0.0.0.0.
The problem I am having is that whenever the IPSec connection is online, I lose all access to the Mikrotik router itself over IP. Traffic *through* the router works fine, I can reach IPs across the VPN tunnel,no problem there. But the only way to access the Mikrotik is via the console cable. It's not even possible over the MAC address.
After some digging around I identified the problem as being the ipsec policy. Whenever I disable the policy, the IP connectivity to the router comes up and I can access it fine via SSH/Winbox. The policy looks like this:
If I change dst-address from 0.0.0.0 to some other network (i.e. the corporate B-Class) then it works, VPN stays up and works fine, I can still access the router itself from the local network. Internet access through the tunnel does not work anymore, obviously, which means this is not an acceptable solution.
Why am I losing connection to the router when the dst-address is 0.0.0.0/0 ? And how can I prevent that while still tunneling everything through the VPN ?
Best regards,
Sylaan
I am evaluating a RB411-3G as a possible replacement for a combination of Cisco router + external 3G modem for some remote locations. The router has to build an IPSec VPN connection to a central Cisco ASA and tunnel everything through, that is corporate traffic and internet access. In Cisco world, this is a normal Remote Access VPN connection where the local network is something like 10.106.200.0/24 and the remote network (i.e. on the ASA side) is "any", i.e. 0.0.0.0.
The problem I am having is that whenever the IPSec connection is online, I lose all access to the Mikrotik router itself over IP. Traffic *through* the router works fine, I can reach IPs across the VPN tunnel,no problem there. But the only way to access the Mikrotik is via the console cable. It's not even possible over the MAC address.
After some digging around I identified the problem as being the ipsec policy. Whenever I disable the policy, the IP connectivity to the router comes up and I can access it fine via SSH/Winbox. The policy looks like this:
Code: Select all
[admin@murs411U-3G] /ip ipsec policy> print detail value-list
src-address: 10.106.200.0/24
src-port: any
dst-address: 0.0.0.0/0
dst-port: any
protocol: all
action: encrypt
level: unique
ipsec-protocols: esp
tunnel: yes
sa-src-address: 0.0.0.0
sa-dst-address: <Cisco ASA Public IP>
proposal: default
priority: 0
Why am I losing connection to the router when the dst-address is 0.0.0.0/0 ? And how can I prevent that while still tunneling everything through the VPN ?
Best regards,
Sylaan