IPSec MikroTik to SonicWall tunnel problem

RouterOS General
1

Hi all,

I’m having an interesting but frustrating issue that hopefully you guys can help provide some insight. I’ve been following these threads for a while and have learned quite a bit from this community of experts. I have a situation where I needed to connect one office to another via the Internet using an IPSec tunnel. The tunnel primarily is being used for voip telephones.

Network A is using a Sonicwall TZ205W with firmware 5.9.0.7 and the remote side (network B) is a RB433 MikroTik router running RouterOS v6.29.1. Each network has a static IP address for their WAN ports, added the Network A lan address in the nat firewall table (192.168.1.0/24 - action, accept), phase 1 and 2 lifetime values match on each end. The tunnel comes up with no problems.

Info:
Network A: Sonicwall 192.168.1.0/24
Network B: MikroTik RB433 192.168.5.0/24
Network C: MikroTik RB433 192.168.0.0/24 (test network)
Problem:
Once the tunnel is up and network B tries to ping any address on network A side (192.168.1.1, 192.168.1.50 etc) I receive request times out. I have let a steady ping run for 5 minutes and longer and they all time out. IF network A sends an icmp packet to network B lan address of 192.168.5.1 OR any active host on the 192.168.5.0/24 subnet my ping requests now work.

If I drop the tunnel, remove all references to installed SA’s, remote peers etc. Bring the tunnel back up my ping requests from network B will timeout until network A sends another ping to network B.

I created another tunnel from network B to my office which is another RB433 I never receive any timeouts. Any side can initiate the tunnel and all packets flow just fine in either direction.

It’s almost as if network B does not know how to route traffic to the 192.168.1.0/24 network until it receives a packet from that subnet.

Has anyone run into anything like this before? I’ve tried to add a static route but I do not see a tunnel interface to route that traffic to it.

Any help is much appreciated and thanks in advance!

Thanks!

T

2

Try adding a static IPSec policy on your Mikrotik.

An IPSec tunnel does not get established until a packet destined for the remote side is encountered. Policies are also how the Mikrotik knows which packets to route over the tunnel. If the sonicwall (network A) established the tunnel, then policies are learnt from it (which is why you can then ping from B to A after it’s established).

IP > IPSec > Policies, Add

Src. Address: 192.168.5.0/24
Dst. Address: 192.168.1.0/24

Action: Encrypt
Level: Require
IPSec Proto: esp
Tunnel: Yes
SA Src. Address: Your public IP of Mikrotik
SA Dst. Address: Your Public IP of Sonicwall
Poposal: default (unless you set up a different one)

3

Hi and thanks for the suggestion. My IPsec policy looks just like what you had suggested. I figured that the network B (mikrotik side) does not know how to route to network A. We confirmed my suspicions by capturing some packets on network A side and could see 0 traffic coming from network B.

Would be so nice to just add a static route to the interface handling the tunnel. Sort of like on a linux box that’s running pptpd. Once the connection has been established that interface shows up on an ifconfig unlike the Mikrotik.

Any other suggestions to get this to work?

T

4

In IPSec > Peers, do you have a peer defined? You probably do, I think the address should be the public IP of the sonicwall.

After that, System > Logging and add an IPSec topic to log to memory.

Then test again, anything interesting in the log?