When we try to build IPSEC tunnel between two network behind Mikrotik router, Installed SA where ‘direction=out’ is missing on the one side while remote side has both Installed SAs for in and out. Packets can travel in one direction with no problem, on the way in opposite direction they are dropped by the policy in ‘Out dropped’.
Mikrotik ver. 2.9.10
[router #1] ip ipsec policy> export
/ ip ipsec policy
add src-address=172.31.255.0/24:any dst-address=192.168.0.0/24:any protocol=all
action=encrypt level=require ipsec-protocols=esp tunnel=yes
sa-src-address=1.1.1.1 sa-dst-address=2.2.2.2 proposal=default
manual-sa=none dont-fragment=clear disabled=no
/ ip ipsec peer
add address=2.2.2.2/32:500 secret=“P4uf7xTH” generate-policy=no
exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=md5
enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no
/ ip ipsec proposal
add name=“default” auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0
pfs-group=modp1024 disabled=no
[router #1] ip ipsec installed-sa> print
0 E spi=0x62738F04 direction=in src-address=2.2.2.2 dst-address=1.1.1.1
auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature
auth-key=“94b2e28ab865ffbd7fdc2763d57639af”
enc-key=“fc7db5e157dabfe81723c9605504a364f48d588b393685f1” add-lifetime=24m/30m
use-lifetime=0s/0s lifebytes=0/0 current-addtime=jan/24/2006 17:33:29
current-usetime=jan/01/1970 00:00:00 current-bytes=0
[router #2] ip ipsec policy> export
/ ip ipsec policy
add src-address=192.168.0.0/24:any dst-address=172.31.255.0/24:any
protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes
sa-src-address=2.2.2.2 sa-dst-address=1.1.1.1 proposal=default
manual-sa=none dont-fragment=clear disabled=no
/ ip ipsec peer
add address=1.1.1.1/32:500 secret=“P4uf7xTH” generate-policy=no
exchange-mode=main send-initial-contact=yes proposal-check=obey
hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d
lifebytes=0 disabled=no
/ ip ipsec proposal
add name=“default” auth-algorithms=md5 enc-algorithms=3des lifetime=30m
lifebytes=0 pfs-group=modp1024 disabled=no
[router #2] ip ipsec installed-sa> print
0 E spi=0x62738F04 direction=out src-address=2.2.2.2
dst-address=1.1.1.1 auth-algorithm=md5 enc-algorithm=3des
replay=4 state=mature auth-key=“94b2e28ab865ffbd7fdc2763d57639af”
enc-key=“fc7db5e157dabfe81723c9605504a364f48d588b393685f1”
add-lifetime=24m/30m use-lifetime=0s/0s lifebytes=0/0
current-addtime=jan/24/2006 17:33:29
current-usetime=jan/01/1970 00:00:00 current-bytes=0
1 E spi=0x8EC0EF05 direction=in src-address=1.1.1.1
dst-address=2.2.2.2 auth-algorithm=md5 enc-algorithm=3des
replay=4 state=mature auth-key=“95ee51b1e831b24a5b092d68cefa522e”
enc-key=“096945f5a5cc44cca7526b22d023640a3b71b70661185155”
add-lifetime=24m/30m use-lifetime=0s/0s lifebytes=0/0
current-addtime=jan/24/2006 17:33:29
current-usetime=jan/01/1970 00:00:00 current-bytes=0