IPsec VPN with multiple subnets in "cryptomap"

RouterOS General
1

Hello,

I am trying to configure IPsec VPN with CISCO ASA with multiple subnets in “cryptomap”. I am fairly familiar with configuring VPNs on ASA side and it is fairly easy to populate cryptomap/NAT exempt objects for specific VPN tunnel but on Mikrotik it seems you need to create specific configuration for “each pair”.

But I have problem running such VPN tunnel.

I have established successful VPN tunnel between MT and CISCO ASA with 1 subnet on each side with following configuration:

IPsec:

/ip ipsec policy group
add name=group_ASA-ZGALT-VPN
/ip ipsec proposal
add enc-algorithms=des name=ESP-DES-SHA pfs-group=none
/ip ipsec peer
add address=22.222.22.22/32 comment=ASA-ZGALT-VPN enc-algorithm=des local-address=188.130.110.37 mode-config=request-only nat-traversal=no \
    policy-template-group=group_ASA-ZGALT-VPN secret=some_secret send-initial-contact=yes
/ip ipsec policy
add dst-address=10.116.11.0/24 group=group_ASA-ZGALT-VPN proposal=ESP-DES-SHA src-address=10.116.111.0/24 template=yes

NAT EXEMPT:

/ip firewall nat
add action=accept chain=srcnat comment=NAT-EXEMPT dst-address=10.116.11.0/24

And get successful traffic through VPN:

ping 10.116.11.129 src-address=10.116.111.1
SEQ HOST SIZE TTL TIME STATUS
0 10.116.11.129 56 125 64ms

But when I try to add more subnets to configuration (to policy) like:

/ip ipsec policy
add dst-address=10.116.30.0/23 group=group_ASA-ZGALT-VPN proposal=ESP-DES-SHA src-address=10.116.111.0/24 template=yes
/ip firewall nat
add action=accept chain=srcnat comment=NAT-EXEMPT dst-address=10.116.30.0/23

I can not establish additional SA and I get error on ASA side: (no errors on MT side)

4 Jan 24 2017 16:18:45 402116 33.33.33.33 22.22.22.22 IPSEC: Received an ESP packet (SPI= 0x1C5205D2, sequence number= 0xF) from 33.33.33.33 (user= 33.33.33.33) to 22.22.22.22. The decapsulated inner packet doesn’t match the negotiated policy in the SA. The packet specifies its destination as 10.116.30.31, its source as 10.116.111.1, and its protocol as icmp. The SA specifies its local proxy as 10.116.11.0/255.255.255.0/ip/0 and its remote_proxy as 10.116.111.0/255.255.255.0/ip/0.

Any ideas where I am doing wrong?

2

You created template for dynamic policies, but policy generation is disabled.
See example here how to make static policies
http://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Policy_and_proposal

3

Are you trying to use your Mikrotik device as a client in you Cisco VPN road-warrior setup? This <<I am trying to configure IPsec VPN with CISCO ASA with multiple subnets in “cryptomap”>> makes me think that you are not. If your goal is to build a true site-to-site VPN tunnel you should use policies instead of policy templates (and in this case you should also avoid using policy template groups).

4

I am trying to create MT as “peer device” so it can establish VPN to ASA or from ASA. Bidirectional VPN. Like 2 offices with multiple subnets.



You created template for dynamic policies, but policy generation is disabled.
See example here how to make static policies
http://wiki.mikrotik.com/wiki/Manual:IP > … d_proposal

I have tried with static policies first… same result.

/ip ipsec policy
add dst-address=10.116.10.0/24 priority=2 proposal=ESP-DES-SHA sa-dst-address=89.164.98.10 sa-src-address=22.22.22.22 src-address=10.116.111.0/24 tunnel=yes
add dst-address=10.116.11.0/24 priority=2 proposal=ESP-DES-SHA sa-dst-address=89.164.98.10 sa-src-address=22.22.22.22 src-address=10.116.111.0/24 tunnel=yes
add dst-address=10.116.30.0/24 priority=2 proposal=ESP-DES-SHA sa-dst-address=89.164.98.10 sa-src-address=22.22.22.22 src-address=10.116.111.0/24 tunnel=yes
5

On a general note, one of the biggest problems with Cisco is terminology. What Cisco calls “cryptomap” is called “IPsec policy” everywhere else outside of the Cisco world.

6

:slight_smile: thanks for noting, would change topic but dont think I can.

Also should I give different “priority” to policies? I have tried, but no luck, although it might be part of bigger problem?

7

set level=unique otherwise only one policy will work with cisco.

8

No, you should not.

Try creating/restoring a setup with policies instead of policy templates, set level=unique. If it does not work, post /ip ipsec export here.

9



Thank you that worked!

10

After several hours and configuraction changes I searched the forum and I can confirm that MRZ answer is correct and working.

Thanks MRZ!