IPsec seems to be broken with 7.21rc

RouterOS General
1

With a seemingly basic config, on a hAP ac device:

/ip ipsec profile
add dh-group=ecp256 dpd-interval=1m enc-algorithm=aes-128 hash-algorithm=sha256 name=strongswan
/ip ipsec peer
add address=83.XXX.28.107/32 exchange-mode=ike2 local-address=10.82.196.249 name=foo-vm profile=strongswan
/ip ipsec identity
add my-id=fqdn:EmberGW.sym peer=foo-vm remote-id=fqdn:foo-vm.sym

/ip ipsec proposal
add auth-algorithms="" enc-algorithms=aes-128-gcm lifetime=1w name=aead pfs-group=none
/ip ipsec policy
add dst-address=83.XXX.28.107/32 peer=foo-vm proposal=aead src-address=10.82.196.249/32

This normally protects a GRE tunnel, but the policy covers all protocols, so I've also tested plain old /ping.

Up to and including 7.20.6, this works without issues. In 7.21rc (both rc1 and rc2), the IKE SA and ESP SAs are established but incoming packets are not being processed.

  • /ip/ipsec/active-peers/print detail looks the same with both versions (IKE SA present, literally the only difference is SPIs which are of course different).

  • /ip/ipsec/installed-sa/print detail shows two ESP SAs, but the "inbound" SA is missing the S (seen-traffic) flag, does not have current-bytes nor current-packets (Winbox shows 0 for both stats).

  • When I try to /ping 83.XXX.28.107 while having /tool/sniffer/quick running, I see ESP-in-UDP packets (port 4500) going out and coming in – ROS is sending ESP-protected ping packets, the server is responding, and ROS sniffer is seeing the ESP-protected responses coming in... but ROS seems to be completely ignoring them.

2

MT regularly breaks IPsec, i personally had several tickets (SUP-206711 for 7.21rc).
It seems that there were not as many problems with open source. It's easier to migrate to another solution; the attitude towards consumers regarding IPsec is careless.

3

Fixed in rc5, thank you very much