Transit IPSEC traffic to another remote site

RouterOS General
1

Hello Mikrotik GURUs,

have a use case and I’m sure there is a solution for it, I’m good at networking :slight_smile: but I never used Mikrotik before, so looking for guidance - Without any delay, I ll let you with this Paint diagram - see attachment
mTIK.png
we have a working IPSEC vpn, 192.168.150.0/24 can reach 172.16.20.0/22 and vise versa.
Users behind Mikrotik can reach the web server 172.20.50.115,
and recently we need the users behind the ASA to reach out to it as well,
I’m open to your suggestion on how to do it, =) I know all the magic will happen at the Mikrotik to transit 192.168.150.0/24 to the webserver 172.22.50.115.

NOTE : this is a policy base VPN.

THANKS A LOT =)

2

Any Mikrotik Guru to help me out on that?

3
  1. On 192.168.x.y MT set route to 172.22.50.x to 172.16.20.1 (if it is the IP of the “middle” MT)
  2. On 172.16.20.1 set NAT rule which changes traffic originating from 192.168.x.y to
add action=src-nat chain=srcnat dst-address=172.22.50.0/24 src-address=192.168.x.y/24 to-addresses=172.16.20.1
4

@batoszP, your approach makes a bit of sense for me but if you could elaborate more that would be great,
First when you say, ““On 192.168.x.y”” or "“On 172.16.20.1"” do you mean Object “similar to ASA naming ?” or simply where I should go in MT to find these ?

172.16.20.1 is the default gateway of the users I have behind the MT,

per my understanding, you want me 1 - to route with source “192.168…” dest ""172.22.50.x’’ next hope “172.16.20.1”
2 - do NAT(type PAT) to Hide the whole subnet 192.168. with a translated IP 172.16.20.1.

could you please help me more to know if my approach is correct, and how to implement using GUI, realy that’s my first time with MT.

Thank you so much !!!