MikroTik <-> Cisco ASA IPSEC

RouterOS Beginner Basics
1

Howdy!

I purchashed a MikroTik firewall to hopefully start replacing the ASA 5505’s that we have been using. I got the IPSEC vpn up between the two firewalls. I can ping everything in both directions. The issue is that nothing else besides ICMP works. SMB, HTTP, or HTTPS. I’ve got roughly 8 IPSEC VPN’s working on the ASA, so I’m fairly sure my config for this one is good also (Well it works for ASA’s, lol). I added the NAT exempt rule on the MikroTik, but do I need to add any access rules? Seems like something simple I’m missing. I am using this at my house and had it with NAT-T, but even tried it with a direct internet connection and still nothing. Sorry for no config, I’ll get that ASAP but just hoping for the DUH moment.

2

Either you configured ipsec policy to encrypt only ICMP or you are dropping everything except ICMP in firewall.

3

Hi MrZ. Sorry for the late reply, It’s been hectic. I’ve double checked, triple checked, and just not seeing the issue. :-/

These are my firewall rules (192.168.168.0/24 Is the remote site, rule labeled 1):

This my policy:

I appreciate any suggestions. :confused:

4

  1. You need to accept UDP 500/4500 and AH/ESP protocols in input chain.

  2. You should accept in forward chain traffic in both directions. Currently you allow only incoming traffic and those accept rules must be before default fasttrack rule.

  3. You need to bypass NAT for traffic that should be encrypted
    http://wiki.mikrotik.com/wiki/Manual:IP/IPsec#NAT_Bypass

5

I’m experiencing same problem after replacing a Cisco 1720 with CCR1009.
Running an IPSEC aes-128 tunnel, I’m able to ping hosts in booth directions, but I’m not able to pass other traffic. To me, it looks like a TCP MSS issue and I have tried to change that using mangle to 1350 and 1300 but without success.
I’m not sure for the mangle rule…perhaps should be done in another way?

/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
add enc-algorithms=aes-128-cbc name=PM

/ip firewall filter
add chain=input comment=aaa protocol=ipsec-esp
add chain=input comment=aaa protocol=udp src-port=500
add chain=input comment=aaa protocol=ipsec-ah
add chain=ipsec comment=aaa protocol=udp src-port=4500

/ip firewall mangle
add action=change-mss chain=forward disabled=yes dst-address=10.11.1.0/24 new-mss=1300 protocol=tcp src-address=10.0.3.0/24 tcp-flags=syn
add action=change-mss chain=forward disabled=yes dst-address=10.0.3.0/24 new-mss=1300 protocol=tcp src-address=10.11.1.0/24 tcp-flags=syn tcp-mss=!0-1300
/ip firewall nat
add chain=srcnat comment="Do not NAT traffic for VRS" dst-address=10.11.1.0/24 src-address=10.0.3.0/24

/ip ipsec peer
add address=0.0.0.0/0 dpd-interval=disable-dpd enc-algorithm=aes-128 generate-policy=port-strict lifetime=2h local-address=0.0.0.0 nat-traversal=no secret=blazkapetraspela
/ip route

Any help or pointing in the right direction will be much appreciated.

6

You are the man MrZ! It was option #2. I guess I never allowed traffic to go out. I appreciate the help!

7

What about NAT bypass? Is that solution worked?

8

NAT Bypass is required. I already had that in there.