I'm experiencing a strange issue where ALL my IPsec SAs (multiple peers, multiple tunnels) get cleared simultaneously every ~48 minutes. The cycle repeats from the time of the last flush, not from router boot.
My environment:
RouterOS version: 7.22 (also present on 7.18.2)
Router model: RB4011iGS+
Number of IPsec peers: 8 of different blends (AWS, Google, private, local - foreign)
Profiles with different lifetimes from 1h to 1d.
All profiles were working fine™ before 2 month ago when one started having random issues
What happens:
At 48min Installed SA’s get cleared for all peers and all policies start to reconnect.
All policies drop
Policies do not get established for a long time unless I manually disable them all and enable them one by one
What I ruled out:
No schedule to drop SA’s
DPD’s are seen to be asked and acknowledged
Internet works fine
Hardware issue - I created backup and restored it on an identical RB4011
What is weird is that at first it was just one peer. The more I started monitoring it the more weird it got now to the point all policies drop and loose connection because of .. something that I can’t pinpoint.
All help would be helpful, any hint would be appreciated as I am growing desperate with this.
Thanks for the idea, I did a simple IPSEC tree export, clear and reimport. Some settings were clashing and although I hoped it was it it wasn’t.
What did you mean with netinstall and useful things? Because the second RB4011 was unused and still on factory settings when I restored backup to it and it behaved the same way.
Some additional development though: we were in contact with the other side of IPSEC and they noticed we have many retransmits that they do not see from other locations (running Cisco though). At this point I’m (re)investing ISP issues but could also say maybe IPsec is just being really slow to reconnect / reissue keys so I’ll be looking into this as well.
Backups have much more than just the text config in them.
They seem to keep a history and other stuff as well.
And the runtime sometimes doesn't exactly match the text config.
A netinstall will do a file system bad block check apparently (in case that is an issue)
Thanks, netinstall will be performed next a downgrade to LTS version was done and behavior is still there.
What I noticed in supout file was the following oddity:
Error loading shared library libudhcp.so: No such file or directory (needed by /pckg/security/nova/bin/ipsec)
2026.03.27-17:32:29.38@3: Error relocating /pckg/security/nova/bin/ipsec: _ZN10DHCPPacket4readEPhj: symbol not found
2026.03.27-17:32:29.38@3: Error relocating /pckg/security/nova/bin/ipsec: _ZNK10DHCPPacket3getE6tag_u8h: symbol not found
2026.03.27-17:32:29.38@3: Error relocating /pckg/security/nova/bin/ipsec: _ZNK10DHCPPacket11getTypeNameEv: symbol not found
2026.03.27-17:32:29.38@3: Error relocating /pckg/security/nova/bin/ipsec: _ZN10DHCPPacket3setE6tag_u8h: symbol not found
2026.03.27-17:32:29.38@3: Error relocating /pckg/security/nova/bin/ipsec: _ZNK10DHCPPacket4dumpER7ostream: symbol not found
2026.03.27-17:32:29.38@3: Error relocating /pckg/security/nova/bin/ipsec: _ZN10DHCPPacket3setE10tag_stringRK6string: symbol not found
2026.03.27-17:32:29.38@3: Error relocating /pckg/security/nova/bin/ipsec: _ZNK10DHCPPacket5writeEPh: symbol not found
2026.03.27-17:32:29.38@3: Error relocating /pckg/security/nova/bin/ipsec: _ZN10DHCPPacket3setE7tag_u32j: symbol not found
2026.03.27-17:32:29.38@3: Error relocating /pckg/security/nova/bin/ipsec: _ZNK10DHCPPacket3getE10tag_stringRK6string: symbol not found
Mikrotik, does ipsec supposed to have dhcp dependancy?
Just an update: I filed Mikrotik support ticket where were were fast to answer to questions until I sent them supout file - now it’s been almost 2 weeks without any answer. Is this typical?
Yes. But that should not be an issue in v7, it was only a problem in v6 where dhcp was a separate package that you could disable or uninstall. In v7 it is always present.
I would say your router is ripe for a clean netinstall and rebuild of the configuration from a previously made /export show-sensitive file=filename (and download of the file). I.e. copy/paste the important config sections one by one.
Did you (or MikroTik) determine what was special about your config that caused this problem? Because I never had such issues with my 4011 and I have several different types of IPsec config on it.
It would be useful to add that to this topic so the solution is not only useful to you but also to other people.