Hello everybody! I got a Cisco 1921 Router with 15.3(3)M3 IOS and i have got a Mikrotik HEX with 6.47.1 RouterOS.
This is only for fun and learning , so this is not for production purposes.
I got the following error from the Cisco side:
" Failed to receive the AUTH msg before the timer expired "
" Auth exchange failed "
And on the Mikrotik side:
" ikev2 init transmit "
They are trying to establish the connection but failed and Mikrotik says that in the policy no phase 2
Here is my configuration, and thank you very much for any help:
Mikrotik:
/ip ipsec profile
add dh-group=modp2048 dpd-interval=disable-dpd enc-algorithm=aes-256 hash-algorithm=sha256 name=Cisco_Mikrotik nat-traversal=no
/ip ipsec peer
add address=something.ddns.net exchange-mode=ike2 name=Cisco profile=Cisco_Mikrotik
/ip ipsec proposal
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc name=Cisco_Mikrotik pfs-group=none
/ip ipsec identity
add peer=Cisco secret=Laci19881124
/ip ipsec policy
add dst-address=10.10.10.0/24 peer=Cisco proposal=Cisco_Mikrotik sa-dst-address=XXX.XXX.193.19 sa-src-address=0.0.0.0 src-address=10.10.14.0/24 tunnel=yes
/ip ipsec profile
add dh-group=modp2048 dpd-interval=disable-dpd enc-algorithm=aes-256 hash-algorithm=sha256 lifetime=1d name=Cisco_Mikrotik nat-traversal=no proposal-check=obey
/ip firewall nat
add action=accept chain=srcnat dst-address=10.10.10.0/24 src-address=10.10.14.0/24
add action=masquerade chain=srcnat out-interface=DIGI_PPPoE
/ip firewall filter
add action=accept chain=input connection-state=established,related,new
add action=accept chain=input dst-port=2200,8291 protocol=tcp
add action=accept chain=input dst-port=500,4500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input protocol=icmp
add action=accept chain=input in-interface=ether4 protocol=ospf
add action=accept chain=input protocol=gre
add action=drop chain=input connection-state=invalid
add action=drop chain=input
add action=accept chain=forward ipsec-policy=in,ipsec
add action=accept chain=forward ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward
add action=drop chain=forward protocol=tcp src-address=XX.XXX.25.41
add action=drop chain=forward protocol=tcp src-address=XXX.XXX.24.228
add action=accept chain=forward connection-state=established,related,new
add action=drop chain=forward connection-state=invalid
Cisco:
crypto ikev2 proposal Cisco_Mikrotik
encryption aes-cbc-256
integrity sha256
group 14
!
crypto ikev2 policy Cisco_Mikrotik
proposal Cisco_Mikrotik
!
crypto ikev2 keyring Cisco_Mikrotik
peer DIGI
address XXX.XXX.179.203
pre-shared-key Laci19881124
!
!
!
crypto ikev2 profile Cisco_Mikrotik
match identity remote address XXX.XXX.179.203 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local Cisco_Mikrotik
crypto ipsec transform-set Cisco_Mikrotik esp-aes 256
mode tunnel
crypto map Cisco_Mikrotik 10 ipsec-isakmp
set peer XXX.XXX.179.203
set transform-set Cisco_Mikrotik
set ikev2-profile Cisco_Mikrotik
match address Cisco_Mikrotik
interface GigabitEthernet0/0
ip ddns update hostname XXX.ddns.net
ip ddns update NOIP
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map Cisco_Mikrotik
ip access-list extended Cisco_Mikrotik
permit ip 10.10.10.0 0.0.0.255 10.10.14.0 0.0.0.255