Mikrotik to Cisco IPSec VPN

RouterOS General
1

Hi

I replaced a customers Cisco ASA 5505 with a CCR1009

There were three IPSec VPN links which I implemented on the CCR1009 and everything is working fine

One thing I don’t understand though is how to point to a VPN link

I need to add a route to guide traffic through one of the VPN links to the routeur that is situated at the other end of the VPN link

I tried creating a route indicating the remote router’s local IP address as gateway but the CCR1009 isn’t able to see it

Any ideas ?
thanks
yann

2

Classic (policy-based) IPsec does not take routing into account by design. IPsec policy is the only thing that determines which traffic gets encrypted and sent over the tunnel.

3

Thanks Andriys
We learn something new everyday

4

Actually I still have a querstion regarding this issue

The LANs at either end can communicate with each other successfully

However I am unable to get the Mikrotik router, that is one end of the IPSec VPN tunnel, to route (dstnat) incoming (internet) traffic to the other end of the tunnel ?

thanks
yann

5

If you still fighting the problem and is in need for help, please post your current config here.

6

thanks Andryis

I figured it out : the problem was that the incoming connection didn’t belong to the LAN
therefore I had to create a srcnat rule to change the source address of the incoming connection