Routing issue through IPsec tunel

RouterOS General
1

Hi guys

I’ve been playing with a mikrotik router for a week now, and starting to love it. There is just two issues I cannot figure out:

  1. When an IPsec tunnel is configured, how do you initiate the tunel?
  2. What do you do with the routing table to make packages go into the tunel?

I created the tunels following this howto
http://gregsowell.com/?p=790#more-790

First I created the tunel to a sonicwall. I ran into these issues, so i replaced the sonicwall with a draytek, and ran into the same issues.

First, when the tunel is created I cannot find any way to initiate the tunel from the mikrotik. I had to do the initiate from the sonicwall / draytek. In both cases the tunel was established.

Then, I tried to ping the remote LAN from the LAN behind the mikrotik. All attempts goto timeout. Tunel-statistc on the mikrotik says 0 packeges trasmitted. Statistic on the sonicwall/draytek shows also 0 packages.
When pinging from the sonicwall / draytek the tunel-statistic on the sonicwall / draytek is counting the pakages as sent, but still 0 packages received. On the Mikrotik statistics remains on 0.

Using packagesniffing I can see that packages supposed to go through the tunel is following the 0.0.0.0/0 route from the mikrotik. Hence my guess that this issue is related to the routingtable. Can anyone help with this?

2

I figured out #2: When creating a IPsec Peer I had to tick [Generate Policy]

Still wondering about #1, how do you initiate the tunel from the MikroTik?

3

=================================================
If you want these IpSec problems FIXED please VOTE for it!

"Implement IPSEC "Virtual Interface" VPN's, allowing easy dynamic routing across IPSEC"

Thanks for your vote!!!

You can control it here I think...

IP -> IPsec -> Peers

  • Double-click on the peer in question.
  • Check "Send initial contact".

The tunnel will not establish for no reason. It will establish the first time the router sees a packet destined for the far end of the tunnel.

=================================================
If you want these IpSec problems FIXED please VOTE for it!

"Implement IPSEC "Virtual Interface" VPN's, allowing easy dynamic routing across IPSEC"

Thanks for your vote!!!