ip-sec between MikroTik and Cisco ASA not passing traffic

RouterOS General
21





It looks like the second part of what you’ve suggested is what’s happening:



If decaps > 0 but encaps = 0, then packets from the ASA side toward the Mikrotik are not being encapsulated by the ASA.

Here’s the output from the ASA, from that particular command:

Result of the command: “show crypto ipsec sa peer <REMOTE_PEER>”

peer address: <REMOTE_PEER>
Crypto map tag: outside_map, seq num: 2, local addr: <LOCAL_PEER>

access-list outside_cryptomap_1 extended permit ip 10.0.0.0 255.255.255.0 192.168.16.0 255.255.255.0
local ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.16.0/255.255.255.0/0/0)
current_peer: <REMOTE_PEER>


#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 12516, #pkts decrypt: 12516, #pkts verify: 12516
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0

local crypto endpt.: <LOCAL_PEER>/4500, remote crypto endpt.: <REMOTE_PEER>/4500
path mtu 1500, ipsec overhead 74(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 045D8340
current inbound spi : 54875E84

inbound esp sas:
spi: 0x54875E84 (1418157700)
SA State: active
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, IKEv2, }
slot: 0, conn_id: 574, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4100432/14844)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x045D8340 (73237312)
SA State: active
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, IKEv2, }
slot: 0, conn_id: 574, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4055040/14844)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

22

Ok. You can probably assume then that your destination on the ASA side is receiving your traffic, but is unable to get return traffic back to you.

This may be due to the ASA not being the default gateway for the 10.0.0/24 subnet. It could be that the ASA IPSec peer interface is not the default route for the ASA. It could be that your 192.168.16/24 subnet is not defined on the 10.0.0/24 subnet default gateway. It could be the ASA is dropping the traffic. It could be that the ASA is NATting the traffic and sending it to the internet.

At this point it appears that you don’t have an IPSec tunnel problem at all. It appears that you have a basic network connectivity issue to troubleshoot. How would you troubleshoot this if the ASA and Mikrotik were connected ethernet to ethernet? Do that.

It looks like the second part of what you’ve suggested is what’s happening:
\

If decaps > 0 but encaps = 0, then packets from the ASA side toward the Mikrotik are not being encapsulated by the ASA.

Here’s the output from the ASA, from that particular command:

Result of the command: “show crypto ipsec sa peer <REMOTE_PEER>”

peer address: <REMOTE_PEER>
Crypto map tag: outside_map, seq num: 2, local addr: <LOCAL_PEER>

access-list outside_cryptomap_1 extended permit ip 10.0.0.0 255.255.255.0 192.168.16.0 255.255.255.0
local ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.16.0/255.255.255.0/0/0)
current_peer: <REMOTE_PEER>


#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 12516, #pkts decrypt: 12516, #pkts verify: 12516
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0

local crypto endpt.: <LOCAL_PEER>/4500, remote crypto endpt.: <REMOTE_PEER>/4500
path mtu 1500, ipsec overhead 74(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 045D8340
current inbound spi : 54875E84

inbound esp sas:
spi: 0x54875E84 (1418157700)
SA State: active
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, IKEv2, }
slot: 0, conn_id: 574, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4100432/14844)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x045D8340 (73237312)
SA State: active
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 2, IKEv2, }
slot: 0, conn_id: 574, crypto-map: outside_map
sa timing: remaining key lifetime (kB/sec): (4055040/14844)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

23

Okay so this is now working. But what is not working is another tunnel (there’s 2 configured on our ASA). It seems to be that either one will work, but not together.

24

This seems familiar, but:

On the ASA, try a “show crypto ipsec sa peer ”. Do you have SAs established (it looks like the Mikrotik thinks SAs are established from your screenshot)? If so, you should see #pkts encaps and #pkts decaps values > 0. If decaps = 0, then encrypted packets are not being received by the ASA. If decaps > 0 but encaps = 0, then packets from the ASA side toward the Mikrotik are not being encapsulated by the ASA.