EoIP Tunnel is Running but not passing traffic

RouterOS Forwarding Protocols
1

First, forgive me for asking what is likely a noob question. I have done a bunch of reading, and tinkering (in GNS3) but have very limited Real World MikroTik experience. I have tried to include all relevant info and details, but if there is anything I can add please let me know. Any assistance would be greatly appreciated.

I have two MikroTik routers a RB952Ui-5ac2nD-TC and a RB931-2nD (hAP mini, and hAP ac lite). Both are running 6.41.3. Both are configured and have internet access. I am trying to get an EoIP tunnel between them. I have the EoIP tunnel created and it appears to be “running”. I have assigned IPs (/30) to the EoIP interfaces but cannot ping from one router to the other.

Here are the tunnel configs and status
----------------------------Router A-------------------------------
/interface eoip
add allow-fast-path=no ipsec-secret=****** !keepalive local-address=
24.19.XX.XX mac-address=02:FB:5D:05:41:95 name=EoIP_to_TACS remote-address=
173.160.XXX.XXX tunnel-id=0
[admin@MikroTik] > int eoip print
Flags: X - disabled, R - running
0 R name=“EoIP_to_TACS” mtu=auto actual-mtu=1408 l2mtu=65535
mac-address=02:FB:5D:05:41:95 arp=enabled arp-timeout=auto
loop-protect=default loop-protect-status=off
loop-protect-send-interval=5s loop-protect-disable-time=5m
local-address=24.19.XX.XX remote-address=173.160.XXX.XXX tunnel-id=0
dscp=inherit clamp-tcp-mss=yes dont-fragment=no ipsec-secret=“******”
allow-fast-path=no
[admin@MikroTik] > ip address print
Flags: X - disabled, I - invalid, D - dynamic

ADDRESS NETWORK INTERFACE

0 192.168.100.1/24 192.168.100.0 ether2
2 192.168.200.1/24 192.168.200.0 ether5
2 192.168.111.1/30 192.168.111.0 EoIP_to_TACS
3 D 24.19.XX.XX/22 24.19.72.0 ether1

----------------------------Router B-------------------------------
/interface eoip
add allow-fast-path=no ipsec-secret=****** !keepalive local-address=
173.160.XXX.XXX mac-address=02:85:0D:B6:D5:16 name=EoIP_to_DJR
remote-address=24.19.XX.XX tunnel-id=0
[admin@MikroTik] > int eoip print
Flags: X - disabled, R - running
0 R name=“EoIP_to_DJR” mtu=auto actual-mtu=1408 l2mtu=65535
mac-address=02:85:0D:B6:D5:16 arp=enabled arp-timeout=auto
loop-protect=default loop-protect-status=off
loop-protect-send-interval=5s loop-protect-disable-time=5m
local-address=173.160.XXX.XXX remote-address=24.19.XX.XX tunnel-id=0
dscp=inherit clamp-tcp-mss=yes dont-fragment=no ipsec-secret=“******”
allow-fast-path=no
[admin@MikroTik] > ip address print

ADDRESS NETWORK INTERFACE

0 192.168.0.1/24 192.168.0.0 ether2
1 173.160.XXX.XXX/30 173.160.XXX.XXX ether1
2 192.168.111.2/30 192.168.111.0 EoIP_to_DJR

2

can you ping remote and local ip’s from each other, I mean can you ping from router B to Router A’ s ip address and from router B to Router A’s ip address. and also change tunnel-id for both side.

3

I can ping the public IP’s of the opposite side (both ways, A->B, B->A).
I cannot ping the EoIP Interface IP from the opposite side. ( A can ping it’s own interface, but cannot ping B’s. B can ping itself, but not A).
I will change the tunnel-id on both and see if that changes.
------UPDATE---------
I logged into site B, to begin changing the tunnel-id. But before I did, I found I had a Terminal still open, so I re-ran the ping that was failing, and all is working.
It appears that letting it sit resolved the issue (whatever it was).

This causes me to ask the question. . . Are EoIP tunnels over the internet commonly flaky? What is the best (proper) way to troubleshoot this type of problem? Again I’m fairly new the MikroTik world. I looked in the log on the routers and all seemed “normal” and it said it was UP, but traffic just wasn’t passing. Any direction would be appreciated.

4

Allow in firewall filter sectionon port udp 500,4500 and GRE /47/ with in-interface WAN and put the rules on top of the section !