Ipsec site to site issue

RouterOS General
1

Hi Guys,

I’m trying to do a vpn site to site between my two offices. Both side use Public static IP, I configured my peer with the Public IP of the other side an leave all others setting default. From my policie, my site 1 use 10.100.1.0/24 as Source and the destination is 192.168.88.0/24 for the SA Source and destination I used the Public IP and set tunnel mode and used the default proposal. I also create a NAT rule on both side, srcnat 10.100.1.0/24 to 192.168.88.0/24 and reverse setting for my site two. Now If I start a ping tool and ping the local Interface on site two (192.168.88.1) I receive a timeout but if I check Under Ipsec Installed SAs, I can see a communication establish with scr public ip and dst public ip. Look like the tunnel is up but not able to communication with the other lan network.

My goal is to be able to reach the other side LAN with all my clients on LAN1.
I also check for some Wiki or videos and everything seem to be correct but like I said, I’m not able to ping the other side.
Under my logs on both side I can see, IPsec-SA established: ESP/Tunnel IPPublic1[0] > IPPublic2[0] spi=RANDOM NUMBER

I’m using the version 6.3 Level 4. Both machine are Under x86 VMWARE.

Thank,

2

When pinging from router specify src-address. Otherwise source and destination will not match configured ipsec policy.

3

Thank for your fast reply. I did this also with the same result (Timeout).

Thank,

4

You should probably not be executing a srcnat on the traffic between sites. In your post it sounded like you specifically doing so.

5

Yes I’m doing scrnat:
Src address: 10.100.1.0/24
Dst address: 192.168.88.0/24
Action Accept.

And reverse on the other side.

Maybe I have to create a new route ? I dont know ??? I’m a bit lost with this.