cannot reach ipsec tunnel destination from another ipsec tunnel

RouterOS Beginner Basics
1

DNI VPN - Page 1.jpeg
Hi experts
As you can see on the image I have two IPSec tunnels, one to a Remote Site, and onother to Windows Azure.
I Can reach both sites like following matrix (using ping and oher protocols):
Local Site → Remote Site 1 = Ok
Remote Site 1 → Local Site = Ok
Local Site → Azure = Ok
Azure → Local Site = Ok

But I cannot reach the Remote Site from Azure like:
Remote Site 1 → Azure = Nok
Azure → Remote Site 1 = Nok

What roules I have to configure to let the remote sites speaking together?
Thanks in advance
best regards
Damian

2

At site 1: 10.10.0.0/16 via 10.1.1.1
At Azure: 172.16.3.0/24 via 10.1.1.1

3

Ok, make sense - but how to apply
can you please post an example command?

4

http://wiki.mikrotik.com/wiki/Manual:Simple_Static_Routing

i.e.

/ip route add dst-address=10.10.0.0/16 gateway=10.1.1.1
5

DNI VPN Page 1.jpeg
hi magchiel
I’m still not able to reach the site.
The actual config is shown above.
Thanks for fourther help
best regards
Damiann

6

It looks to me like you need this additional policy on local site:

/ip ipsec policy
add dst-address=10.10.0.0/16 sa-dst-address=237.237.237.111 sa-src-address=188.188.188.82 src-address=172.16.3.0/24 tunnel=yes

Plus the same on Azure’s side.

7

Or, alternatively, do not use direct IPsec in tunnel mode, but use a tunnel interface (IPIP, GRE, L2TP) with IPsec protection
and then route the traffic via that tunnel interface.

8

+1

Using IPsec in transport and seperate tunneling makes routing a piece of cake.

9

Hmm, this seems to be a challange for me…

first challange: get azure to local site tunnel (237.237.237.111 ↔ 188.188.188.82)
2nd challange: get traffic trough this tunnel to SN 10.1.0.0/16 and second adapter/network on local site (10.254.254.0/24)
3rd challange: include remote site (147.147.147.145) with tunnel between local site to allow trafic from/to azure and from and to local site

any suggestions how to reach that?
Thanks very much
Best regards
Damian
Azure localSite remoteSide logical - Page 1.png