Need help with IPSec VPN problems. No connecting

RouterOS General
1

I have setup the IPSec VPN Settings like the example from the Mikrotik page with Masq. But it doesn’t ever try to connect or give any errors at all. What am I doing wrong? The log never mentions anything about an attempted connection or anything. I have to be missing something. They can ping each others real ips fine but no VPN connection is ever attempted.


1st Router

/ ip address
add address=76.196.97.6/30 network=76.196.97.4 broadcast=76.196.97.7 interface=ether1 comment=“” disabled=no
add address=192.168.4.1/24 network=192.168.4.0 broadcast=192.168.4.255 interface=ether2 comment=“” disabled=no

/ ip firewall nat
add chain=srcnat action=accept src-address=192.168.4.0/24
dst-address=192.168.0.0/22 comment=“” disabled=no
add chain=srcnat action=masquerade out-interface=ether1 comment=“”
disabled=no


/ ip ipsec proposal
add name=“default” auth-algorithms=sha1 enc-algorithms=3des lifetime=30m
lifebytes=0 pfs-group=modp1024 disabled=no
/ ip ipsec policy
add src-address=192.168.4.0/24:any dst-address=192.168.0.0/22:any
protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes
sa-src-address=76.196.97.6 sa-dst-address=76.196.98.6 proposal=default
manual-sa=none dont-fragment=clear disabled=no
/ ip ipsec peer
add address=76.196.98.6/32:500 secret=“test” generate-policy=yes
exchange-mode=aggressive send-initial-contact=yes proposal-check=obey
hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d
lifebytes=0 disabled=no

2nd Router

/ ip address
add address=76.196.98.6/30 network=76.196.98.4 broadcast=76.196.98.7
interface=ether1 comment=“” disabled=no
add address=192.168.0.1/22 network=192.168.0.0 broadcast=192.168.3.255
interface=ether3 comment=“” disabled=no


/ ip firewall nat
add chain=srcnat action=accept src-address=192.168.0.0/22
dst-address=192.168.4.0/24 comment=“” disabled=no
add chain=srcnat action=masquerade out-interface=ether1 comment=“”
disabled=no


/ ip ipsec proposal
add name=“default” auth-algorithms=sha1 enc-algorithms=3des lifetime=30m
lifebytes=0 pfs-group=modp1024 disabled=no
/ ip ipsec policy
add src-address=192.168.0.0/22:any dst-address=192.168.4.0/24:any
protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes
sa-src-address=76.196.98.6 sa-dst-address=76.196.97.6 proposal=default
manual-sa=none dont-fragment=clear disabled=no
/ ip ipsec peer
add address=76.196.97.6/32:500 secret=“test” generate-policy=yes
exchange-mode=aggressive send-initial-contact=yes proposal-check=obey
hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d
lifebytes=0 disabled=no

2

As you’re manually specifying a policy you need

generate-policy=no

.

Use main mode unless you really need aggressive mode.

Turn on IKE logging. VPN connection will only be created when there’s traffic to encrypt. Ping from a client at one end to an address at the other.

Regards

ANdrew

3

The problem is somewhere with my policy I think. Nothing you told me to change made it even attempt to connect. If I change the dst-address=192.168.0.0/22:any in the policy to something say 0.0.0.0/0 it’ll connect but I get issues. As soon as I mess with that though it’ll go crazy and flood me with pretty IPSEC things. But If i never change it it wont show ANYTHING IPSEC relatated. Also whats the way to make them connect automaticly and stay connected 24/7?

4

well it seems to be working now. Crazy stuff. But i’m not gonna complain. Thanks for your input. I’m pretty sure that fixed it even though i’m not sure why.