HowTo Use IPSec VPN as backup link

RouterOS General
1

Hi Everybody

Consider the following Network Diagram (sorry I don’t respect conventionnal images and I don’t have Visio…)

I manage the ROS Board with IP : 172.17.10.254

I configured this as follows :

/interface bridge add name=bridge_lan arp=enabled

/interface bridge port add bridge=bridge_lan interface=ether4
/interface bridge port add bridge=bridge_lan interface=ether3
/interface bridge port add bridge=bridge_lan interface=ether2

/ip address add address=172.17.10.254/24 interface=bridge_lan


/interface bridge add name=bridge_net arp=enabled
/interface bridge port add bridge=bridge_net interface=ether1
/ip address add address=172.16.143.250/24 interface=bridge_net

 /ip route add dst-address=0.0.0.0/0 gateway=172.16.143.254 type=unicast

I added some firewall rules

/ip firewall filter add chain=output src-address=172.17.10.0/24 dst-address=172.20.0.0/24 action=accept
/ip firewall filter add chain=input src-address=172.20.0.0/24 dst-address=172.17.10.0/24 action=accept

Created the IPSec Tunnel accordingly with the other side (that I don’t manage)

All works fine, but the speed is slow..
So another company added a WirelessLink between the Local and Remote Site.
The link is available directly via the “172.16.143.254” gateway when we try to reach the network 172.20.0.0/24


My wish is to have the IPSec to act as a backup link…

So :
I tried to add a static route

 /ip route add dst-address=172.20.0.0/24 gateway=172.16.143.254

but no luck… th IPSec tunnel seems to catch all traffic prior to the basic route.
Is there a way to specify priority : so try to reach the remote address in the range 172.20.0.0/24 by 172.16.143.254 and if unreachable, try via the IPSec Tunnel…

Thanks for your answers…
And sorry if I made mistakes.. my english is not perfect
IMG_20170206_0001.png

2

If you disable your IPSec policy, the packets go over the primary link?

The IP Sec policy actually catches the packets after the basic route, but the packets still match the IPSec Policy so they’ll go over the IPSec connection.

Options:

  1. Remote site chooses a different VPN type, one that gives you an interface so you can route accordingly.

  2. 172.16 network handles the decision on link choice, you’d always use IPSec and the 172.16 network routes the entire IPSec connection over primary/backup.

  3. If you have no control at all over the others, disable IP Sec Policy and create a script that’ll ping the 172.20 network, if no response then enable the IP Sec policy. But then to ping the 172.20 network over primary link, you’d have to disable IP Sec Policy, ping, if it’s still not working, re-enable IPSec Policy. This script would not be too hard to create..

  4. Wait for someone else to reply with a better solution :smiley:

3

Hi Van.
First of all, thanks for your answer.

You’re right, if I disable IPSec Ploicies, after a small amount of time, packets go through the defined route (primary access).
I don’t have any control on remote sites choices… otherwise, I would have proposed an IPIP tunnel to replace the IPSec tunnel…

you said :

The IP Sec policy actually catches the packets after the basic route, but the packets still match the IPSec Policy so they’ll go over the IPSec connection.

Is there a way (via mangle rules) to mark packets in order to tell the IPSec policy, these packets doesn’t match the policy route ?

For the moment, I disabled the IPSec policies AND masquerading for subnet 172.17.10.0/24 when packets go to 172.20.0.0/24, otherwise the remote site (172.20.0.0) isn’t able to connect to local machines sucha as printers…

4

I looked for a way to use packet marks to route, but I don’t see any of those options in the IPSec policy.

You need an interface to route on, the only way I can think of how is to use another Mikrotik (a small cheap one) and offload the IPSec to it.

So in the diagram your Mikrotik would have two routes for packets destined to 172.20.0.0/24. The first route with distance=0 will route through 172.16.143.25. Your default route 0.0.0.0 would handle this so you don’t actually need to create this route.

The second route, the backup route with distance=1 would send 172.20 packets to 172.15.0.1. That second mikrotik would then route back to 172.17.10.254 but these packets would be wrapped in the IPSec ESP packet destined to public IP of 172.20 network.

You’d have to port forward UDP 4500 and 500 on your first Mikrotik to 172.17.10.253.
pic1.png