Hello!!!
I have two mikrotik routers: RB4011 iGS (LAN 100.10.1.0) and CCR1016 - 12G (LAN 10.0.0.0). I do IPSec Site to Site tunnel connection and it works fine. I need to netmap on CCR1016 LAN 10.0.0.0 to address 10.5.0.0, because LAN 10.0.0.0 is reserved to another network .
When I add Firewall rules on CCR1016:
rule0 /ip firewall nat chain=dstnat dst-address=10.5.0.0/24 src-address=100.10.1.0/24 action=netmap to-addresses=10.0.0.0/24
rule1 /ip firewall nat chain=srcnat dst-address=100.10.1.0/24 src-address=10.5.0.0/24 action=netmap to-addresses=10.0.0.0/24
I have log information: ‘failed to pre-process ph2 packet’ and ‘ipsec:input:in:ether1 out: (unknown 0)…’.
I have similar situation between two networks. I have site-to-site VPN between 10.0.0.0/24 and 10.95.0.150. In my case I only need different source address when connecting to destinations 80 and 443 port, so I have created NAT rule that changes source IP to 10.0.25.x when connecting to 10.95.0.150:80 or 443. Maybe this helps for you as well.
The only thing to come to my mind is that the NAT rules you’ve added affect the IPsec IKE packets, so they arrive to the 4011 from an unexpected address. So follow the suggestion in my automatic signature below when these rules are in place.
Also, the rules you’ve posted seem to do something else than what you’ve described in plain words.