EDIT: for a mysterious reason it suddenly started to work. Deja vu…
Please help. It’s a config that used to work (recreated, but it’s along the same principles and the IPs are the same), but now the connection doesn’t even start initialising. Enabled the IPsec debug log, but besides config changes, nothing is logged. Torch shows no signs of initiating transfer on port 500 or anywhere related to the IPsec connection… I’m pretty clueless. Below is my config, there’s of course the additional NAT rule which is not included but for now it’s not relevant since the connection doesn’t even want to start initialising. I’m pinging the other end’s private IPsec address to start it.
Peer 1 (x86 5.14)
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1 disabled=no enc-algorithms=aes-128 lifetime=30m name=default pfs-group=modp1024
/ip ipsec peer
add address=15.15.208.42/32 auth-method=pre-shared-key dh-group=modp1024 disabled=no dpd-interval=2m dpd-maximum-failures=5 \
enc-algorithm=aes-128 exchange-mode=main generate-policy=yes hash-algorithm=sha1 lifebytes=0 lifetime=1d my-id-user-fqdn=\
router.xxx.com nat-traversal=no port=500 proposal-check=obey secret=asdfghjkl123 send-initial-contact=yes
/ip ipsec policy
add action=encrypt disabled=no dst-address=192.168.55.0/24 dst-port=any ipsec-protocols=esp level=require priority=0 proposal=\
default protocol=all sa-dst-address=15.15.208.42 sa-src-address=25.25.35.234 src-address=192.168.56.0/24 src-port=any tunnel=\
yes
/ip address
add address=25.25.35.234/24 comment="router access" disabled=no interface=ether2 network=25.25.35.0
add address=192.168.56.1/24 disabled=no interface=ether1 network=192.168.56.0
Peer 2 (RB450G 6.0rc13)
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128
/ip ipsec peer
add address=25.25.35.234/32 enc-algorithm=aes-128 generate-policy=\
port-override hash-algorithm=sha1 my-id-user-fqdn=hq.xxx.com secret=\
asdfghjkl123
/ip ipsec policy
add dst-address=192.168.56.0/24 sa-dst-address=25.25.35.234 sa-src-address=\
15.15.208.42 src-address=192.168.55.0/24 tunnel=yes
/ip address
add address=10.11.12.1/24 interface=ether2 network=10.11.12.0
add address=192.168.55.1/24 interface=ether2 network=192.168.55.0
(public ip 15.15.208.42 is on eth1, dhcp assigned but static)