Two IPSec tunnels from the same network

RouterOS General
1

Hello,

I’m trying to configure this tunnels:

Tunnel1: 10.0.0.0/24 → 10.20.0.0/24
Tunnel2: 10.0.0.0/24 → 10.20.0.32/28

Tunnel1 always work, but I get no traffic through Tunnel2. The SA for Tunnel2 does get stablished, but count bytes stay at 0.

Whow should I set this up on Mikrotik?
Thanks!

IPSec: several local subnets to one tunnel
2

I had an issue with same setup on RB1200 and Cisco ASA 5510.

3

Forgot to mention, I’m using Mikrotik on both ends, RB1000 and 450G.
For Cisco I’ve read that the policy has to be set as “unique” instead of “require”.

4

10.20.0.32/28 is covered by 10.20.0.0/24, so if you you haven’t added a priority, the first one created wins.

5

Hello!

I’ve tried using higher priority (for example 100, 1000, 9999…) for 10.20.0.32/28 bu it still doesn’t work.

Thanks for the tip!

6

Thank you for help. It works !

7

Glad to hear that, slech :slight_smile:

I’ve manager to get it done by:

  • Defining two IPSec policy, each one for the needed tunnel:
    Tunnel1: 10.0.0.0/24 → 10.20.0.0/24
    Tunnel2: 10.0.0.0/24 → 10.20.0.32/28

  • Setting them as “unique” instead of “required”.

  • Setting the priority for Tunnel2: 10.0.0.0/24 → 10.20.0.32/28 quite higher than that for Tunnel1:
    Tunnel1, priority 0
    Tunnel2, priority 200

It hasn’t worked for me using smaller priority diferentials, say priorities 0 and 1.

  • Lastly, change that crappy dsl router for another model which allows IP Protocol 50 (ESP) passthrough and not just UDP 500 Dnat’ing.

Hope this helps!