I have a main Mikrotik router with a static public IP address. Behind the Mikrotik router, I have a few local networks and a p2p ethernet link to the Cisco router.
On the main Mikrotik router, I have 2 IPsec tunnels terminated towards the branch sites.
Now I need to create an IPsec tunnel that will be terminated on the Cisco router which is behind the Mikrotik router and on the other side is the customer’s Cisco router.
My concern is if this is possible to have the IPsec tunnel terminated on the Mikrotik, and another tunnel that is passing through the Mikrotik router and is terminated on some device behind the Mikrotik? Anybody had a similar setup?
In your particular scenario where Cisco R2 has a public address, it is possible from the Mikrotik R1 perspective, because you can tell it to handle IPsec traffic to/from the public address of Cisco R2 in a specific way. Since there is NAT on the path between Cisco R1 and Cisco R2, not only the setup will be a tad more complicated on them, but also the overhead of the transport packets will be 8 bytes larger because to allow traversing the NAT, the ESP has to be encapsulated into UDP. If you wanted to get rid of this reduction of efficiency, you would have to assign the public IP address of Mikrotik R1 also to Cisco R1 in addition to its private address on WAN, and use NAT on both the Mikrotik and the Cisco to fool the NAT detection between the two Ciscos, which I know how to do on Mikrotik but I’ve never tried on Cisco.
