Hi!
I have created a IPsec tunnel between tow sites.
Site A Mikrotik
Public IP: aaa.aaa.aaa.aaa , Local subnet: 192.168.5.0/24
Site B CheckPoint
Public IP: bbb.bbb.bbb.bbb , Local subnet 1: 10.11.1.0/25; Local subnet 2: 10.10.10.192/26
IPSec policy tab shows that Phase 2 connection established. So tunnel is created.
Side B admin asking me to configure ip translation to make all packets going from our site have sites A public IP in source addresses.
In other words I should configure NAT to translate all packets going from sites A local network to sites A public address.
I have created srcnat rules for each local network of Site B.
0 chain=srcnat action=src-nat to-addresses=aaa.aaa.aaa.aaa src-address=192.168.5.0/24
dst-address=10.11.1.0/25 out-interface=ether1 log=yes log-prefix=“SRCNAT-0”
1 chain=srcnat action=src-nat to-addresses=aaa.aaa.aaa.aaa src-address=192.168.5.0/24
dst-address=10.10.10.192/26 out-interface=ether1 log=yes log-prefix=“SRCNAT-192”
But Sites B admin reporting me that all packets that came from Site A has source address 192.168.5.x.
What I am doing wrong?
Detailed configuration of Mikrotik:
/ip ipsec policy
1 A src-address=192.168.5.0/24 src-port=any dst-address=10.11.1.0/25
dst-port=any protocol=all action=encrypt level=require
ipsec-protocols=esp tunnel=yes sa-src-address=aaa.aaa.aaa.aaa
sa-dst-address=bbb.bbb.bbb.bbb proposal=VPN ph2-count=1
2 A src-address=192.168.5.0/24 src-port=any dst-address=10.10.10.192/26
dst-port=any protocol=all action=encrypt level=require
ipsec-protocols=esp tunnel=yes sa-src-address=aaa.aaa.aaa.aaa
sa-dst-address=bbb.bbb.bbb.bbb proposal=VPN ph2-count=1
/ip ipsec peer
0 ;;; Unsafe configuration, suggestion to use certificates
address=bbb.bbb.bbb.bbb/32 profile=VPN auth-method=pre-shared-key
secret=“superpassword” generate-policy=no policy-template-group=default
exchange-mode=main send-initial-contact=yes
/ip ipsec peer profile
0 name=“VPN” hash-algorithm=sha256 enc-algorithm=aes-256,3des
dh-group=modp1536,modp1024 lifetime=1d proposal-check=obey
nat-traversal=yes dpd-interval=2m dpd-maximum-failures=5
/ip ipsec proposal
0 name=“VPN” auth-algorithms=sha256
enc-algorithms=aes-256-cbc,aes-256-ctr,aes-256-gcm lifetime=8h
pfs-group=modp1536
/ip firewall filter> print
1 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked
2 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid
3 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp
4 chain=input action=accept protocol=tcp src-address-list=WinboxAllowedIPs
dst-port=8291 log=no log-prefix=“”
5 chain=input action=accept protocol=udp dst-port=500 log=no log-prefix=“”
6 chain=input action=accept protocol=udp dst-port=4500 log=no log-prefix=“”
7 chain=input action=accept protocol=udp dst-port=1701 log=no log-prefix=“”
8 chain=input action=accept protocol=ipsec-ah log=no log-prefix=“”
9 ;;; Allowed PPTP
chain=input action=accept protocol=tcp dst-port=1723 log=no log-prefix=“”
10 chain=input action=accept protocol=gre log=no log-prefix=“”
11 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN
12 ;;; defconf: accept in ipsec policy
chain=forward action=accept ipsec-policy=in,ipsec
13 ;;; defconf: accept out ipsec policy
chain=forward action=accept ipsec-policy=out,ipsec
14 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection
connection-state=established,related
15 ;;; defconf: accept established,related, untracked
chain=forward action=accept
connection-state=established,related,untracked
16 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid
17 ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new
connection-nat-state=!dstnat in-interface-list=WAN
/ip firewall nat
0 chain=srcnat action=src-nat to-addresses=aaa.aaa.aaa.aaa src-address=192.168.5.0/24
dst-address=10.11.1.0/25 out-interface=ether1 log=yes log-prefix=“SRCNAT-0”
1 chain=srcnat action=src-nat to-addresses=aaa.aaa.aaa.aaa src-address=192.168.5.0/24
dst-address=10.10.10.192/26 out-interface=ether1 log=yes log-prefix=“SRCNAT-192”
2 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none