MikroTik

spr41178

Hello Team, I am facing an issue with my RB5009 and wondering if anyone else has faced anything similar. After an upgrade or a power failure or a power loss the router fails to startup. You have to manually remove the power and start it again and everything works fine after that. Any ideas? Thank you.

spr41178

I haven't changed eth2-eth5 queues from the default, which is only-hardware-queue on my router. I never tried pcunite's approach, sorry. I wanted a simple configuration and - the key point - ability to use while FastTrack is enabled. It works great without taxing CPU too much. I don't have to fiddl...

spr41178

I use it only with fq-codel on the bridge interface for download and ether1 (WAN) for upload.

Good morning, understood,

So two questions the rest of the childs you leave as queue=default?

And do you use it with pcunites solution?

Thank you very much and have a good day

spr41178

Yup, that's correct, the new-priority=from-dscp-high-3-bits takes care of it. It maps the values like this: DSCP 0-7 -> Priority 0 DSCP 8-15 -> Priority 1 DSCP 16-23 -> Priority 2 etc. Good afternoon, Excellent work and article. Quick question if i wanted to prioritize SIP and RTP packets, 5060,506...

spr41178

I found an old thread (https://forum.mikrotik.com/viewtopic.php?t=113308) that talks about using QoS with FastTrack enabled. That got me interested. After reading the thread and also reviewing packet flow documentation, I came to realize I can successfully use this approach with fq_codel. /queue ty...

spr41178

@sindy email hPI++wBDSNzxZwOMRwHL9J7UdbAookhj2xMyO7ywK1qzt7KByQEpJAxrkllWR8Oj 4Xk+pRZTlMj/v/PgNMcv0MhuN270M3GOiTnUb1vjYIcrjT5wyukcvBifv3042f9E /iqz2VPizDv5+TQZdHFdwmrp52Cw7J3mvPaECPhLYHLDAPeNWin2h4Mu7fc+sAfW WYZE/SlAsQWypyDXcVaEhw/HzUMC2kh9B/69rj2KeJ//iC11ZsXpMk0UHYvz3tPa snH7jc5c+gYCBjyudPH8XZPCc0q...

spr41178

smyers119 I don’t have some problem in particular. I just have a few logs and wireshark traces from a training session which state the problem for example no voice or one way voice in a sip communication and I want to analyze shortly in the answer how I come up with an answer based on the traces or ...

spr41178

Good evening, Can anyone with sip tracing skills help me out with some wireshark pcap files and logs privately? Kind of like a training session NOT free of charge of course. I want a walkthrough on how to solve a couple of questions which state the problem and need the answer through the traces and ...

spr41178

The procedure was successful...

Thank you all for your contribution and effort and especially @sindy for the code.

One more (tick) for the knowledge book.

Have a nice day

spr41178

That's all the ISP shared with us and how it works so far.

I am going to try Sindy's solution today as i will visit the site.

spr41178

I may be missing something, but a masquerade rule does exactly what its name suggests, it makes connections coming from both 172.21.0.0/16 and 192.168.100.0/24 appear to come from 192.168.30.80 to the rest of 192.168.30.0/24. The connection tracking remembers this in each connection's context, so w...

spr41178

As you haven't posted your current configuration, let me assume that sfp-sfpplus1 is your current single WAN interface ether1 is free So copy the code below, substitute sfp-sfpplus1 and ether1 by the actual names of the interfaces, and paste the result on a command line: /system script add name=rec...

spr41178

or whether you create a VLAN on the single common bridge and make two WAN ports access ports to that VLAN on the bridge depends on your own decision. Good morning Sindy, I think that this is probably what they want to be done from my side. The problem is that i don't know how to do it. Would it be ...

spr41178

It isn't clear where VLANs come into this as none of the description mentions them other than your last sentence, a diagram may be helpful. If the ISP is suggesting you can connect the two internet connections can simply be connected together by a switch you could configure two ports on the CCR1009...

spr41178

Good afternoon, I have a case where the ISP has the following scenario. An optic fibre link with a speed of 150Mbps and a backup sat link in case the 1st one fails . Both outputs belong to a /28 subnet with an ip range of xx.xx.xx.244 - xx.xx.xx.254 The gateway is xx.xx.xx.241 and if i am not mistak...

spr41178

Good afternoon, I am trying to connect two different subnets on a rb1100 and i am facing the following issue. I have a hotspot network that belongs to the rb1100 with a range of 172.21.0.0/16 on interface ether11 which in turn end up to a couple of access points for internet access. On these access ...

spr41178

@JelleM Sorry to bother you again but i am facing an issue. Will explain what i did and if you can tell me what is wrong i will appreciate it. I took a link cable and added it on a free interface on the rb1100 lets say ether10 which is on its own and not bridged with the hotspot network I added a fr...

spr41178

Good afternoon, I have installed dude 3.6 on a Windows 10 computer simply to probe a port to see if a client is online. I am using 3.6 as i want it to work standalone without a server. On my home computer Windows 10 resolving name to address works fine and i can add new devices. When i install it at...

spr41178

Good morning forum, I have created an L2TP over IPSEC interface and connect to it from a Windows 10 computer. I can ping everything and access everything via Web Interface that i need but i can't seem to get the Neighbor Discovery to work. I try to see the MikroTik Router via Winbox but it doesn't s...

spr41178

So these are completely separate network? If so you are going to have to create a link (cable) between the management network and the RB1100. Add a dhcp client on the interface, configure src-nat masquerade and allow traffic from 172.21.0.0/16 to the server IP and back. Be very careful to not give ...

spr41178

Good afternoon. I have one RB1100 installed at a hotel that is used as a hotspot system for giving access to internet to its clients. The hotspot range is 172.21.0.0/16 What is needed now is as follows. On their management side they have a Server and a seperate subnet 192.168.30.0/24 that doesn't ha...

spr41178

OK, so then use this modified version: :foreach i in=[/ip ipsec policy find comment="put_your_comment"] do={ :if ($i != "*FFFFFF") do={ :local state [/ip ipsec policy get $i value-name=ph2-state] :if ($state != "established") do={ /ip ipsec policy disable number=$i :de...

spr41178

Hi, you can try this code. I use the main part of this code just to inform me when PH2 is down, but in this case I modify it to disable, wait 10 sec and re-enable the policy. Give it a try. :foreach i in=[/ip ipsec policy find where action!=discard] do={ :if ($i != "*FFFFFF") do={ :local ...

spr41178

Good morning, I would like a script that checks the PH2 state of a specific policy and if it finds it at no phase2 it will disable and re-enable it. I am having an issue where one of my policies if for any reason gets interrupted it goes to no phase2 and the only way it comes back online is to disab...

spr41178

If you set the passive parameter of peer1 at Branch to yes , it might be OK even without the NAT rules. If you keep it at no , whenever the site-to-site connection goes down, the Branch router will try to actively connect to Home until the connection attempt in the opposite direction (from Home to ...

spr41178

Is there any reason to quote my directly preceding post as a whole? This is no e-mail, I could see what I wrote just above even if you answered a month later. Is there any way of doing this but with dynamic ip? My Public IP on both MikroTik's are not statically assigned. Sure. One pre-requisite to ...

spr41178

OK, so I was blind and haven't noticed the profile named ikev2 in your export from Home above, which uses default values of all parameters, so it 1. admits modp2048 and 2. doesn't show any parameters except the name in the export, as default values of parameters are not shown unless you use the ver...

spr41178

The two Phase 1 proposals coming from the phone are indeed incompatible with the Phase 1 proposal (specified on both /ip ipsec profile rows) of RouterOS, hence I have no idea why the same phone connects successfully when it connects using some other uplink than the WiFi at the Branch. I.e. all the ...

spr41178

One public IP and the phone is passing through the MikroTik at Branch. If so, the IKE initial request from the phone arrives to Home with the same source IP like the site-to-site tunnel from the Branch Mikrotik itself. So normally also the one from the phone should match on the first peer with that...

spr41178

Checking the Branch Log from my home for the specific date i was there shows up with nothing either but the Home point had this in the log section after all ... can you give me roughly an idea on how to dstnat at Branch Mikrotik? No point in doing so as the whole assumption that it is a dstnat issu...

spr41178

Since the log at Home Mikrotik shows nothing whilst the Strongswan did have a chat with some IPsec stack, and since I remember your previous issue, I would expect dst-nat rules at Branch Mikrotik to divert the IPsec connection attempt to the Branch Mikrotik itself. So as the first thing, check the ...

spr41178

Good afternoon, I have two points one Branch and one Home connected via IKEv2 together working fine. I also connect to my Home via a 2nd IKEv2 connection via Strongswan with certificates with my Android Phone that also works fine. Connecting to my Home with Strongswan via WiFi or LTE or any other Wi...

spr41178

The rule action=dst-nat chain=dstnat comment="CCTV Port Forward" dst-port=37777 in-interface=WAN protocol=tcp to-addresses=192.168.5.103 to-ports=37777 at Home doesn't care about the original destination address. So even if the VPN client in 192.168.6.0/24 connects to 192.168.0.x:37777, t...

spr41178

Maybe it has something to do with port 37777 not reaching the Branch office? It's not "port 37777 not reaching the Branch office", it's "packets with destination port 37777 not reaching the IP address of the camera in the branch office". And yes, if the camera accepts incoming c...

spr41178

Forwarding Good morning add action=accept chain=forward dst-address=192.168.5.0/24 in-interface=WAN ipsec-policy=in,ipsec src-address=192.168.0.0/24 add action=accept chain=forward dst-address=192.168.0.0/24 in-interface=WAN ipsec-policy=in,ipsec src-address=192.168.5.0/24 add action=accept chain=f...

spr41178

(1) I have never used bridge filter so wondering if this is better placed in input chain if necessary or is this something hotspot requires?? /interface bridge filter add action=accept chain=forward disabled=yes dst-port=67 ip-protocol=udp mac-protocol=ip out-interface=WAN src-port=68 add action=dr...

spr41178

Adding a srcnat 192.168.6.0/24 to 192.168.0.0/24 seems to have solved my issue. If so, it means that the firewall at the branch machine doesn't accept incoming connections from 192.168.6.0/24. So the above is rather a workaround than a solution. Any suggestion in how to accept them? I have tried th...

spr41178

Adding a srcnat 192.168.6.0/24 to 192.168.0.0/24 seems to have solved my issue. I am having web interface access to everything on the 0.0 network plus winbox access. However when i try to view my cameras at the 0.0 network through the Dahua application from my phone (part of 192.168.6.0 client) as l...

spr41178

I will simplify the firewall tomorrow, remove the bloatware and repost. I will add the forwarding chains also and try. I like the priorities -->tomorrow, tonight Ouzo comes first!! ;-) What I mean is start from defaults and ONLY add what you need to allow the devices and users on or using your netw...

spr41178

I will simplify the firewall tomorrow, remove the bloatware and repost.

I will add the forwarding chains also and try.

spr41178

Forum rules: please edit your post and place [ code] and [ /code] tags around the configuration export. To the topic: as a minimum, a policy for 192.168.0.0/24 <=> 192.168.6.0/24 is missing in the configuration of the tunnel between "branch" and "home". Add it accordingly at bot...

spr41178

Better show the complete configuration export. It may be the firewall, it may be the IPsec policies, it may be missing routes. Check my signature below regarding non-destructive anonymisation. /interface bridge add arp=proxy-arp name=bridge1 /interface ethernet set [ find default-name=ether1 ] name...

spr41178

Can you please show your /ip routes?

Home Point
/ip route
add distance=1 gateway=192.168.1.1
add comment=vpn01 distance=1 dst-address=192.168.0.0/24 gateway=bridge1
add distance=1 dst-address=192.168.6.0/24 gateway=bridge1

spr41178

Good Afternoon all. I have one IKEv2 VPN between two sites Branch and Home Branch is 192.168.0.0/24 Home is 192.168.5.0/24 Everything works perfectly. I have created a second IKEv2 with certificate between my phone and the Home point with Strongswan VPN client for Android. This works too. The second...

spr41178

Figured that out also.

Had to change IP: to DNS: in the server Certificate

spr41178

Figured it out.

I had to re enable the server certificate in the identity section.

However i am having trouble using a dns name instead of a public ip.

I am getting fatal error authentication failed.

Any ideas?

spr41178

Good afternoon to all. I have added a small test IKEv2 VPN with Strongswan according to the Wiki. Everything worked ok the first time with the certificates but then i tried changing my public ip to my cloud name reissued new certificates and i keep getting can't get private key in the log section. I...

spr41178

OK. So if you look higher into the capture, you should see that at the beginning of the call, both parties (the PBX and the phone) send RTP packets to each other. Then, at some moment, RTP stops coming to the phone because the VPN stops working for a while, and after some time since the last RTP pa...

spr41178

Good afternoon, My issue still persists and is a bit hard to find as it is happening at no particular fix timings...sometimes it happens after a minute sometimes as long as 45 minutes but since i am not talking constantly on the SIP phone i can't figure it out. I have a question regarding the firewa...

spr41178

Hello to everybody, A small update on the matter. Disabling DMZ and port forwarding from the router itself to ports 500,1701 and 4500 to the Tik seem to have made the trick for the WiFi connection. And of course the relevant firewall filter command to accept these ports. Don't know if this is a fluk...

spr41178

Both Androids have 9.0. That might be it... do you want me to give a try from my 8.1.0? If so, I can send you my public key and instruction how to use it to send me the contact information via a forum post securely. The test account may get an address blocked by firewall so it wouldn't get anywhere...

spr41178

No unfortunatelly...the other side has no Tik's or anything. Just an ISP router where the android phone connects to it via the onboard WiFi. Hm. What's the Android version? My 8.1.0 "Just Works" via both 4G and WiFi... the L2TP/IPsec server is 6.44.6. The ISP blackbox may have its own IPs...

spr41178

OK, so you can see three things from there: the Mikrotik sends the responses back to the mobile but they apparently never reach it, as it keeps re-sending the first packet, so the next question is whether they are leaving through the right interface (which is what the first column of the command li...

spr41178

So static IPSEC entries mean /ppp l2tp-server enabled but without the use of ipsec in that menu? Correct. Setting use-ipsec to no in /ip l2tp-server server will not prevent actual use of IPsec but it will just prevent the dynamic IPsec configuration from being created. The dynamically created one u...

spr41178

21:34:18 ipsec,info respond new phase 1 (Identity Protection): 192.168.1.235[500]<=>xxxxxxxxxxx[500] 21:34:21 ipsec,info the packet is retransmitted by xxxxxxxxxxxxx[500]. 21:34:24 ipsec,info the packet is retransmitted by xxxxxxxxxxxxx[500]. 21:34:27 ipsec,info the packet is retransmitted by xxxxxx...

spr41178

the packet is retransmitted about 5 times then phase1 negotiation failed Please check in the firewall and make sure UDP 4500 is accepted in the input chain... ALso, from a quick look at yout config, tunnel=no, not yes... Otherwise Tunnel Mode is used and not Transport mode... I have port 500,1701,4...

spr41178

the packet is retransmitted about 5 times then phase1 negotiation failed Which "the" packet? The first response one from the Mikrotik to the phone or one of the later ones? I've seen multiple cases recently which behaved similarly - the initial negotiation failed at some stage. In one cas...

spr41178

Does the log say anything when you try to connect through WiFi? Any errors ? the packet is retransmitted about 5 times then phase1 negotiation failed i tried creating it manually but i must be doing something wrong i dial in and it says established but the phone still tries to connect (shows connec...

spr41178

I can connect from an android device using LTE to the L2TP without any problems BUT if the device switches to WIFI and tries to connect it fails miserably. Is the Android phone connected to the WiFi provided by the very same 4011 which is the L2TP/IPsec server, or is it provided by the same Mikroti...

spr41178

i can't seem to figure out how to add it manually and point it to the L2TP server on 6.46.x version. You will have to create an IPsec in transport Mode, not tunnel mode, manually and then create your L2TP Tunnel over the IPsec and then add the appropriate routes... This way you actually do what the...

spr41178

Great to hear that...

Thank you!

Attaching newest link! Sorry if i ask so many questions the past few days!

viewtopic.php?f=2&t=159887

spr41178

Good afternoon, Newest problem is as follows if you can point me out to what is causing this issue. I have an L2TP with IPSEC server running on a MikroTiK RB4011. I can connect from an android device using LTE to the L2TP without any problems BUT if the device switches to WIFI and tries to connect i...

spr41178

@zacharias @ sindy No need for modifications from my side - When i remove the routes connectivity works fine i only lose the ping within the tiks but i had to point to an interface to ping as Zacharias suggested. Everything works as intended and wether i keep the routes or remove them nothing change...

spr41178

@zacharias @sindy still trying to capture logs and replicate the error but it seems it is not hanging up now...still under investigation cos when it was happening it was happening at different timings. Mind you i did upgrade my PBX firmware so still checking to see. No rest for the wicked i have ano...

spr41178

i can't ping anything from within the Tik's Yes because Mikrotik itself does not know how to reach the other side,it uses as source address the one at your WAN Interface... Totally normal... Go to Tools-> Ping, type the address you want to ping and from the second tab set as source address the addr...

spr41178

OK. So if you look higher into the capture, you should see that at the beginning of the call, both parties (the PBX and the phone) send RTP packets to each other. Then, at some moment, RTP stops coming to the phone because the VPN stops working for a while, and after some time since the last RTP pa...

spr41178

I see that a different port is used and the log could looking for ports 5060 and 5061. In /ip service you can add your port to the SIP line. https://help.vantact.com/index.php?/Knowledgebase/Article/View/25/0/how-to-disable-sip-alg-on-a-mikrotik i use 6060 port instead of the common 5060. differenc...

spr41178

@zacharias @sindy have a look at this screenshot from wireshark locally. This happened within the 7th minute I tried sniffing damn thing i was on for 15 minutes never dropped. i will try it again when someone is available on the other side tomorrow. @andriys PBX log shows nothing of use..even when t...

spr41178

You could start a ping to the PBX and when the call hungs check if you lost ICMP packets...

Will try that as well
Thanks

spr41178

I do not know what PBX you use, but in some cases you must add an entry to the PBX Whitelist, in your case the subnet 192.168.5.0/24 or just 192.168.5.250 ... A call that cuts after 6 minutes is not a NAT problem to me... Also make sure that the PBX allows to the extention to be used outside the LA...

spr41178

dst-nat is not necessary. The phone and the PBX can see each other transparently thanks to the VPN. And yes, do disable the SIP ALG at both Tiks, although it usually doesn't cause this kind of problems. Other than that, set /tool sniffer at both ends to sniff into file named something.pcap and filt...

spr41178

Does your PBX write logs? Is there anything interesting in the logs?
What is the indicated termination cause for the dropped calls in question?

Good pointer - I have enabled the PBX's SysLog and i have it collecting info to see if it points out to something from its side.

spr41178

To add to what @sindy said, make sure on both your sides under Firewall -> services sip alg is disabled... Also, on your PBX, do you see the phone being registered with its local IP ? And not the Routers... SIP ALG is disabled on both sites The IP of the SIP phone is 192.168.5.250 The PBX IP is 192...

spr41178

From the networking perspective, there are three independent packet exchanges when it comes to SIP phones: SIP registration: the phone periodically updates the user account on the PBX with its current contact IP address and port. There is no other payload in the messages but the contact itself. The...

spr41178

Attached Firewall

spr41178

@zacharias @sindy

viewtopic.php?f=2&t=159766

spr41178

Good afternoon After a successful IPSEC site to site VPN that had some routing issues with a VOIP PBX on the HQ side https://forum.mikrotik.com/viewtopic.php?f=2&t=159613 I am facing something new now that has to do with the above post. The SIP extention that registers to the PBX network experie...

spr41178

You are welcome... Have a nice day

@Zacharias @sindy Hello again!
New problem but it regards the VPN connectivity i reckon...can i post it here or should i start a new topic?

spr41178

@sindy i agree with you, ofcorse he can make a selective port forward... The fact that i suggested DMZ is so that he doesnt have to configure the ISPs Router every time a new portforward is needed. So we transfer everything to the Mikrotik including the Security Load... @spr41178 i new that was it ...

spr41178

@sindy both routers are behind NAT without any DMZ or Portforward on the ISP side... So that explains it i guess... Good afternoon, The HQ ISP Router had DMZ enabled, the Branch didn't have it so i enabled it but that wasn't the problem. As you pointed out the gateway was wrong on the IP Printer an...

spr41178

@sindy exactly, thats why i said that a default route is enough... nice to know about the second case you describe... @spr41178 i would first suggest complete the DMZ and then see it again... There is no point on trying to solve it now... Indeed, i will check the DMZ on the HQ and the default gatew...

spr41178

Also i missed the routes earlier, they are not needed at all... It is Wrong... In IPsec, all we need is a default route in our routing table so that the packet during the Routing Deicision does not get discarded... All the rest will hapen because of the IPsec Policy!!! Yes, no routes towards the IP...

spr41178

Also i missed the routes earlier, they are not needed at all... It is Wrong... In IPsec, all we need is a default route in our routing table so that the packet during the Routing Deicision does not get discarded... All the rest will hapen because of the IPsec Policy!!! My routes you mean are not ne...

spr41178

This gave me access to both devices...thanks for the input. But why are these two assets failing to come through like the rest without the need of these nat rules? Because, as both @Zacharias and me have suggested, these devices either miss a default route (to 0.0.0.0/0), or a specific route to a s...

spr41178

To overcome the suspected issue of a missing route to 192.168.5.0/24 (or the default route) on the two devices, you can use src-nat rules on the Mikrotik at the HQ: /ip firewall nat add chain=srcnat action=src-nat out-interface=bridge1 dst-address=192.168.0.250 src-address=192.168.5.0/24 to-address...

spr41178

Really?
Yes i would DMZ both my routers...

DMZing the one i have here.

Will get back to you as to what i have at HQ as i am not sure.

spr41178

Do you have static IP on your ISPs Routers and then with DMZ or port forward you send the traffic to the Mikrotiks ? As for the improvements, i will start with the most important ones, your Firewall is not good at all... Static IP on one side (HeadQuarters) Dynamic IP on the other side that changes...

spr41178

There are some improvents that you could make on your config, but besides that i cant really see a reason why you cant ping or access in particular your PBX and the Printer... Are you sure those 2 devices have correctly configured as gateway the address 192.168.0.254 ? Is you PBX accessible from ou...

spr41178

Is it a L2TP/IPsec tunnel or just an IPsec site to site tunnel ? In case it is a IPsec tunnel, under IP Firewall NAT, on the 192.168.5.0/24 side, have you created a src nat rule with dst address 192.168.0.0/24 action accept and placed at the very top? Same must be done to the other side but for the...

spr41178

Without seeing your configuration, no ideas at all. See my automatic signature right below for anonymisation hints. The only things which come to my mind without seeing the configuration are missing/wrong routes to 192.168.5.0/24 on the two devices (as the IP ranges for the L2TP clients and the IPS...

spr41178

I guess AES CBC is not done fully in hardware thats why... *** AES-CBC and AES-CTR only encryption is accelerated, hashing done in software https://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Hardware_acceleration You could contact support and let us know as well... Thank you my friend - will investigat...

spr41178

Good Afternoon,

I have a CHR 6.46.4 installed.
Is there a way to enable the hardware acceleration flag for cbc encryption? I only see it in gcm encryption.

Thanks

spr41178

You cannot do multicast over such a setup. You can either use tunnel interfaces (like GRE or IPIP) with IPsec protection and use multicast routing (when you can get it to work for this application), or you can use EoIP to join the two networks at L2 level (so they need to use the same subnet addres...

spr41178

Good afternoon, I have a working ipsec VPN with policies between two RB4011's. My problem is i fail to ping and have a web interface access to 2 out of 5 devices which is strange. Headquarters IP 192.168.0.0/24 Branch IP 192.168.5.0/24 I can ping and have web access to the following 192.168.0.127, 1...

spr41178

To anyone interested or having the same problem disable all your Custom Sip Headers on the device and it will work.

spr41178

Anyone?

spr41178

Good afternoon, I have an IPSEC VPN set with policies between branch and home with rb4011 on either side. The VPN works great no problems whatsoever, pings, web interfaces on either sides. SITE A NETWORK IS 192.168.0.0/24 SITE B NETWORK IS 192.168.5.0/24 I am trying to get a lan messenger to work th...

spr41178

Any ideas?

spr41178

Good afternoon... I have the following scenario that seems to be troubling me quite alot. I have a working IPSEC VPN connection through a CCR1009 and RB4011 two remote sites. Lets name the sites CCR1009 SITE A with IP 172.21.1.1 172.21.0.0/16 RB4011 SITE B with IP 172.11.1.1 172.11.0.0/16 SITE B has...

spr41178

Marking the post which contained the solution as such, which you've already done, is the closest action to closing the topic. So nothing left to do. Just FYI, doing so does not prevent the topic from being used further, it just indicates that the OP has got a useful solution to people who got here ...

spr41178

"ipsec exclusion" means that you have to prevent packets which should be grabbed by the ipsec policies from getting src-nat'ed (as src-nat handling takes place before ipsec policy matching, so after the packets get src-nat'ed, the ipsec policy ignores them). So in the chain=srcnat of /ip ...

spr41178

Add the following IPSEC policies: On site A: from subnet B to subnet C via peer C On site A: from subnet C to subnet B via peer B On Site B: from subnet B to subnet C via peer A On Site C: from subnet C to subnet B via peer A No need to add routes, unless you want router-to-router access, then add ...

spr41178

Do you use native IPsec with policies or you use IPsec to transport some tunnel protocol?

Good afternoon,

Native IPsec with policies - Not using any tunneling protocol

spr41178

You can try this and see if it helps, make changes as required. SITE B router /ip firewall nat add action=accept chain=srcnat comment="VPN to C" dst-address=172.21.0.0/16 src-address=192.168.20.0/24 /ip route add check-gateway=arp comment="VPN to C" distance=2 dst-address=172.21...

spr41178

Good afternoon all, Quick question if i can have your assistance. I have successfully created two ipsec connections as follows SITE A TO SITE B SITE A TO SITE C SITE A has a static IP, SITE B AND C have Dynamic IP's but i have added a script that works with Mikrotik's Cloud to translate it and apply...

spr41178

How did you mark the pptp packets and bypass them in fasttrack please?

spr41178

Can someone please advice me on how to start a new topic? it has been over a week registered and i can't find a way to do so...

spr41178

Hello to all, i can't post a new topic yet so i will ask a question and if someone can help me i would appreciate it. I have a PPTP server set up everything works perfect on my remote site i have 5 RB951Ui2HnD and 5 Engenius Access Points. The remote site is set up as a hotspot. My remote range is 1...

spr41178

Any sollution?

spr41178

Sorry to have to post on this section but i am not allowed to still post a new topic. My question is similar. I have a PPTP server set up everything works perfect on my remote site i have 5 RB951Ui2HnD and 5 Engenius Access Points. My remote range is 172.21.0.0/16 and my access points have static ip...

spr41178

Thank you for answering. Patience then!

spr41178

I am having a different problem, when i pptp client to server (two RB 750S) i log just fine to the server but i get blank pages no configuration whatsoever by either mac or ip.

If i pptp from windows dial-up i can access the server fine. Any thoughts?!

spr41178

Non related question if you can help me how did you manage to post a topic? I am registered and can't manage to start a new topic.

spr41178

Any sollution yet to your problem? I too have the same question as where to enter the code
Thanks in advance

Search found 114 matches