I am trying to connect 2 networks via ipsec ad when i goto remote peers it tells me its established yet there isn’t any Installed SA’s working and I cant ping locally either. Ex) i cant ping from one office to the other. Likes I cant ping 192.168.10.1 from 192.68.11.1. Below are my settings and a depiction of the networks
Settings for 192.168.10.x router
# jan/02/1970 00:19:35 by RouterOS 6.11
/interface ethernet
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
set [ find default-name=ether5 ] master-port=ether2
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \
mac-cookie-timeout=3d
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=md5,sha1,null enc-algorithms=des \
lifetime=8h pfs-group=modp768
/ip pool
add name=dhcp_pool1 ranges=192.168.10.2-192.168.10.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=ether2 name=dhcp1
/port
set 0 name=serial0
set 1 name=serial1
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface l2tp-server server
set enabled=yes max-mru=1460 max-mtu=1460
/ip address
add address=192.168.10.1/24 interface=ether2 network=192.168.10.0
add address=24.**** interface=ether1 network=24.****
/ip dhcp-server network
add address=192.168.10.0/24 gateway=192.168.10.1
/ip dns
set servers=8.8.8.8,24.92.226.12
/ip firewall filter
add chain=input disabled=yes protocol=ipsec-esp src-address=192.168.88.54
/ip firewall nat
add chain=srcnat comment="IPSEC RULE" dst-address=192.168.11.0/24 \
src-address=192.168.10.0/24
add chain=srcnat protocol=ipsec-esp
add chain=dstnat protocol=ipsec-esp
add action=masquerade chain=srcnat out-interface=ether1
add action=dst-nat chain=dstnat comment=PPTP disabled=yes dst-port=1723 \
in-interface=ether1 protocol=tcp to-addresses=192.168.10.2 to-ports=1723
add action=dst-nat chain=dstnat comment=PPTP disabled=yes dst-port=1723 \
in-interface=ether1 protocol=udp to-addresses=192.168.10.2 to-ports=1723
/ip ipsec peer
add address=50.*****/32 dh-group=modp768 dpd-interval=10s enc-algorithm=\
des lifetime=8h nat-traversal=yes secret="****"
/ip ipsec policy
add dst-address=192.168.11.0/24 sa-dst-address=50.***** sa-src-address=\
24.**** src-address=192.168.10.0/24 tunnel=yes
/ip route
add distance=1 gateway=24.****
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
/ip upnp
set allow-disable-external-interface=no
/system identity
set name=MTSMFRI
/system ntp client
set mode=broadcast
Settings for 192.168.11.x router
# jan/02/1970 00:19:13 by RouterOS 6.11
#
/interface ethernet
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
set [ find default-name=ether5 ] master-port=ether2
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \
mac-cookie-timeout=3d
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=md5,sha1,null enc-algorithms=des \
lifetime=8h pfs-group=modp768
/ip pool
add name=dhcp_pool1 ranges=192.168.11.2-192.168.11.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=ether2 name=dhcp1
/port
set 0 name=serial0
set 1 name=serial1
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/ip address
add address=192.168.11.1/24 interface=ether2 network=192.168.11.0
add address=50.**** interface=ether1 network=50****
/ip dhcp-server lease
add address=192.168.11.102 client-id=1:0:30:1b:47:b7:a3 mac-address=\
00:30:1B:47:B7:A3 server=dhcp1
add address=192.168.11.101 client-id=1:0:e0:b6:15:b6:a9 mac-address=\
00:E0:B6:15:B6:A9 server=dhcp1
add address=192.168.11.100 client-id=1:0:e0:b6:13:71:2e mac-address=\
00:E0:B6:13:71:2E server=dhcp1
add address=192.168.11.103 client-id=1:0:c0:ee:b2:b9:79 mac-address=\
00:C0:EE:B2:B9:79 server=dhcp1
/ip dhcp-server network
add address=192.168.11.0/24 gateway=192.168.11.1
/ip dns
set servers=192.168.11.1,8.8.8.8
/ip firewall filter
add chain=input protocol=ipsec-esp src-address=192.168.88.53
/ip firewall nat
add chain=srcnat dst-address=192.168.10.0/24 src-address=192.168.11.0/24
add chain=srcnat dst-address=192.168.11.0/24 src-address=192.168.10.0/24
add chain=srcnat protocol=ipsec-esp
add chain=dstnat protocol=ipsec-esp
add action=masquerade chain=srcnat out-interface=ether1
/ip ipsec peer
add address=24.**** dh-group=modp768 dpd-interval=10s enc-algorithm=\
des lifetime=8h nat-traversal=yes secret="****"
/ip ipsec policy
add dst-address=192.168.10.0/24 sa-dst-address=24.**** sa-src-address=\
50.**** src-address=192.168.11.0/24 tunnel=yes
/ip route
add distance=1 gateway=50.****
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
/ip upnp
set allow-disable-external-interface=no
/system identity
set name=MTSMWEL
/system ntp client
set mode=broadcast
Can you check that you have routes for the remote LAN pointing to the remote WAN address? The configs didn’t seem to show such routes. The SAs won’t be created until traffic causes an IPSEC attempt.
I think I am a bit lost here. So you want me to take the 24.x.x.x router that hosts the 192.168.10.x range and put a route in it for the remote router? Such as dst=192.168.11.0/24 with a gateway of the public remote 50.x.x.x ?
I have no idea on what i am to look for;
There is nothing there saying it has failed or anything of the sort.
Perhaps I am fighting firmware issues? I have v6.11…? Does it have issues with IPSEC?
Nope. Downgraded to 6.7 and it didn’t make a difference… Also tried 5.26 with same results
Ive also tried different encryption types… idk… i just need to tunnel these networks… at this point idc how lol
