ipsec tunnel is lying mikrotik-mikrotik 6.9

RouterOS General
1

Prompt what I’m doing wrong?'s Tunnel router configuration but does not rise.
so I configured:
Mikrotik_1:
/interface eoip add name=“eoip_test” tunnel-id=176 remote-address=IP_Mikrotik_2 local-address=IP_Mikrotik_1
/ip address add address=10.168.176.10/24 interface=eoip_test comment=IP_eoip_test
/ip ipsec peer add address=10.168.176.20/32 port=500 auth-method=pre-shared-key secret=“123456”
/ip ipsec policy add src-address=172.17.105.0/24 src-port=any dst-address=192.168.176.0/24 dst-port=any sa-src-address=10.168.176.10 sa-dst-address=10.168.176.20 tunnel=yes action=encrypt proposal=default
/ip firewall nat add chain=srcnat action=accept place-before=0 src-address=172.17.105.0/24 dst-address=192.168.176.0/24

Mikrotik_2:
/interface eoip add name=“eoip_test” tunnel-id=176 remote-address=IP_Mikrotik_1 local-address=IP_Mikrotik_2
/ip address add address=10.168.176.20/24 interface=eoip_test comment=IP_eoip_test
/ip ipsec peer add address=10.168.176.10/32 port=500 auth-method=pre-shared-key secret=“123456”
/ip ipsec policy add src-address=192.168.176.0/24 src-port=any dst-address=172.17.105.0/24 dst-port=any sa-src-address=10.168.176.20 sa-dst-address=10.168.176.10 tunnel=yes action=encrypt proposal=default
/ip firewall nat add chain=srcnat action=accept place-before=0 src-address=192.168.176.0/24 dst-address=172.17.105.0/24

Here is the output of - export
Mikrotik_1:
/ip ipsec proposal set [ find default=yes ] auth-algorithms=md5,sha1 enc-algorithms=3des,aes-128-cbc,aes-192-cbc,aes-256-cbc
Mikrotik_2:
/ip ipsec peer
add address=10.168.176.10/32 secret=123456
/ip ipsec policy
add dst-address=172.17.105.0/24 sa-dst-address=10.168.176.10 sa-src-address=10.168.176.20 src-address=192.168.176.0/24 tunnel=yes
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=md5,sha1 enc-algorithms=3des,aes-128-cbc,aes-192-cbc,aes-256-cb

2

Nobody can help?
If you need to add more information, be sure to ask complement.
Thank you!

3

What are you trying to do? A site to site VPN over the internet or something else?

If you’re trying to do a site to site over the internet, unless you’ve changed the IPs to something other than your actual addresses for security, the sa-src-address and sa-dst-address addresses are wrong. The sa-src-address should be the public address of the local unit (unless you’re doing a dynamic source like I set up) and the sa-dst-address should be the address of the remote unit. 10.x.x.x addresses are private and non-routeable.

4

I want to raise a tunnel between remote locations (offices)
For reasons of clarity I raise between EoIP and want inside this tunnel L2 raise IPSec.
Why do not you correct address if I raise IPSec inside EoIP!?

Please give an example implementation that I realized my mistake or tell what I did wrong (why not the correct address? Tunnel is addressing the gray tunnel EoIP)

5

Help me understand what the problem is!

6

Help me understand what the problem is!