Site to site VPN - can only establish from one end

RouterOS Beginner Basics
1

I set up site2site VPN from Mikrotik to Cisco ASA, and it is functioning, apart from that I can only establish the link when initiating traffic FROM the ASA side.

Example: every ping from MT side will time out, until I ping from ASA side, where the peer connection will be established, and both sides can ping eachother.

(I can provide more info on configs on both ends - just using standard set up, the first howto listed when googling)

But, do anyone have any suggestion regarding something obvious I should try to find/fix the problem? Given that the link is working perfectly once it is established, I would guess that there could be issues with the initial negotiating traffic originating FROM the Mikrotic that is somehow blocked by a firewall rule or similar.

I am regularly maintaining IPSEC VPN tunnels from ASA to ASA, but this is the first time I am attempting this with a Mikrotik

thanks for your help!

2

What does your peer config look like on the Mikrotik side?

3

Here’s the setup at the Mikrotik side

/ip ipsec proposal
set [ find default=yes ] auth-algorithms=md5 enc-algorithms=3des

/ip firewall nat
add chain=srcnat comment="Ipsec NAT bypass" dst-address=172.16.0.0/21 src-address=192.168.110.0/24

/ip ipsec peer
add address=<<<Wan IP at Cisco ASA>>>/32 dpd-interval=disable-dpd enc-algorithm=3des hash-algorithm=md5 nat-traversal=no secret=**********
/ip ipsec policy
add dst-address=172.16.0.0/21 sa-dst-address=<<<Wan IP at Cisco ASA>>> sa-src-address=<<Wan IP at Mikrotik>> src-address=192.168.110.0/24 tunnel=yes

following this guide: http://www.vionblog.com/mikrotik-to-cisco-asa-ipsec-vpn/

4

To connect a IPSEC tunnel from a Mikrotik to a Cisco ASA you’ll need to add the “level=unique” setting to your policy.

On a side note highly suggest you change your crypto and hashing to AES (higher the better) and SHA1 at a minimum.

/ip ipsec policy
add dst-address=172.16.0.0/21 sa-dst-address=<<<Wan IP at Cisco ASA>>> sa-src-address=<<Wan IP at Mikrotik>> src-address=192.168.110.0/24 tunnel=yes level=unique
5

mikrotik and cisco asa site2site vpn https://www.youtube.com/watch?v=3sntW7f9GOU