Understanding IPSec VPN. Send initial contact or no?

RouterOS Beginner Basics
1

Hi!

I try create IPSec Tunnel between two Mikrotik 5.21 (MT1 and MT2) in test lab Oracle VirtualBox, but i cant see any udp500 or ipsec-esp traffic
(I try this on two MT AH1100AHx2 with no result)


[both MT] > ip ipsec statistics print
in-errors: 0
in-buffer-errors: 0
in-header-errors: 0
in-no-states: 0
in-state-protocol-errors: 0
in-state-mode-errors: 0
in-state-sequence-errors: 0
in-state-expired: 0
in-state-mismatches: 0
in-state-invalid: 0
in-template-mismatches: 0
in-no-policies: 0
in-policy-blocked: 0
in-policy-errors: 0
out-errors: 0
out-bundle-errors: 0
out-bundle-check-errors: 0
out-no-states: 0
out-state-protocol-errors: 0
out-state-mode-errors: 0
out-state-sequence-errors: 0
out-state-expired: 0
out-policy-blocked: 0
out-policy-dead: 0
out-policy-errors: 0





[MT1] > ip address print

ADDRESS NETWORK INTERFACE

0 10.0.0.1/24 10.0.0.0 ether2 wan
1 192.168.1.1/24 192.168.1.0 ether1 lan1

[MT2] > ip address print

ADDRESS NETWORK INTERFACE

0 10.0.0.2/24 10.0.0.0 ether2 wan
1 192.168.2.2/24 192.168.2.0 ether1 lan2

[MT1] > ip route print

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 ADC 10.0.0.0/24 10.0.0.1 ether2 wan 0
1 ADC 192.168.1.0/24 192.168.1.1 ether1 lan1 0

[MT2] > ip route print

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 ADC 10.0.0.0/24 10.0.0.2 ether2 wan 0
1 ADC 192.168.2.0/24 192.168.2.2 ether1 lan2 0

[MT1] > ip firewall nat print
0 chain=srcnat action=accept src-address=192.168.1.0/24 dst-address=192.168.2.0/24
1 chain=srcnat action=masquerade out-interface=ether2 wan

[MT2] > ip firewall nat print
0 chain=srcnat action=accept src-address=192.168.2.0/24 dst-address=192.168.1.0/24
1 chain=srcnat action=masquerade out-interface=ether2 wan



[both MT] > ip firewall filter print
0 chain=input action=accept protocol=udp dst-port=500
1 chain=input action=accept protocol=udp dst-port=4500
2 chain=input action=accept protocol=ipsec-esp
3 chain=input action=accept protocol=tcp dst-port=8291 (i see input traffic only on this rule)
4 chain=input action=accept
5 chain=input action=accept connection-state=established
6 chain=input action=accept connection-state=related
7 chain=output action=accept
8 chain=forward action=accept


[MT1] > ip ipsec policy print
0 src-address=192.168.1.0/24 src-port=any dst-address=192.168.2.0/24 dst-port=any protocol=all action=encrypt
level=require ipsec-protocols=esp tunnel=yes sa-src-address=10.0.0.1 sa-dst-address=10.0.0.2 proposal=default
priority=0

[MT2] > ip ipsec policy print
0 src-address=192.168.2.0/24 src-port=any dst-address=192.168.1.0/24 dst-port=any protocol=all action=encrypt
level=require ipsec-protocols=esp tunnel=yes sa-src-address=10.0.0.2 sa-dst-address=10.0.0.1 proposal=default
priority=0

[MT1] > ip ipsec peer print
0 address=10.0.0.2/32 port=500 auth-method=pre-shared-key secret=“1234” generate-policy=no exchange-mode=main
send-initial-contact=yes nat-traversal=no my-id-user-fqdn=“” proposal-check=obey hash-algorithm=md5
enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 dpd-interval=2m dpd-maximum-failures=5

[MT2] > ip ipsec peer print
0 address=10.0.0.1/32 port=500 auth-method=pre-shared-key secret=“1234” generate-policy=no exchange-mode=main
send-initial-contact=yes nat-traversal=no my-id-user-fqdn=“” proposal-check=obey hash-algorithm=md5
enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 dpd-interval=2m dpd-maximum-failures=5


[both MT] > ip ipsec proposal print
0 * name=“default” auth-algorithms=sha1 enc-algorithms=3des lifetime=30m pfs-group=modp1024


Where I go wrong? Help me please.

2

P. S. All interfaces in virtual box are internal (private “wan”, “lan1”, “lan2”)

3

The tunnels wont establist unless there is traffic flowing which needs the tunnels.

For example, do a ping from MK2 like this:
ping address=192.168.1.1 interface=LAN

Send initial contact means if the mikrotik is to establish a tunnel if its not established yet. Basicly it controls which side of the tunnel is allowed to establish it. Usefull when one side has a dynamic IP.

4

tomaskir, big tnx!

[MT2] > ping address=192.168.1.1 interface=“ether2 wan”
HOST SIZE TTL TIME STATUS
192.168.1.1 56 64 9ms
192.168.1.1 56 64 0ms

5

I was wrong, sorry

[admin@MT2] > ping address=192.168.1.1 interface=“ether1 lan2”
HOST SIZE TTL TIME STATUS
192.168.1.1 timeout
192.168.1.1 timeout

Now i see peers and installed SA`s, but cant ping other subnet

6

Delete the SAs on both sides, see if it re-negotiates properly again and works after that.

Also, turning on DPD with reasonable values will help this. Like 5 sec and 2 failures.

7

I do it, but nothing.

May be need create routes to 192.168.1.0/24 and 192.168.2.0/24? Then through which gateway?

8

create static route on each mkt for remote network, or put default route (your wan interface), right now your router doesn t know where to send packet for remote network (in routing table you have only directly connected networks)

9

You do NOT need routes when using Policy based IPSec.

Look at the packet flow, the router internally resolves where to send packets for policy based IPSec.

http://wiki.mikrotik.com/wiki/Manual:Packet_Flow

Did new SAs get negotiated and ping doesnt work, or did it not negotiate new SAs?

10

New SAs get negotiated and ping doesnt work

But in firewall connection i see unreplied icmp-packets

[MT2] > ip firewall connection print

PR.. SRC-ADDRESS DST-ADDRESS TCP-STATE TIMEOUT

0 SA udp 10.0.0.1:500 10.0.0.2:500 2m58s
1 SA tcp 10.0.0.100:1034 10.0.0.2:8291 established 4m59s
2 S ip.. 10.0.0.2 10.0.0.1 9m59s
3 icmp 192.168.2.2 192.168.1.1 9s

11

[MT1] > ip firewall connection print

PROTOCOL SRC-ADDRESS DST-ADDRESS TCP-STATE TIMEOUT

0 icmp 192.168.2.2 192.168.1.1 7m47s
1 SA tcp 10.0.0.100:1033 10.0.0.1:8291 established 23h52m3s
2 S ipsec… 10.0.0.2 10.0.0.1 2m3s
3 SA udp 10.0.0.1:500 10.0.0.2:500 5m1s

12

You said it worked in the first post. What have you done since then?

Have you tried disabling policy and peer on both routers and then enabling them again?

13

In first post i ping from wan interface (directly connected to second router) and ping working.


Yes, i do it

14

I have created two host machine in subnets

[PC1] 192.168.1.11

[PC2] 192.168.2.22

a ping from them

[PC2] > tool traceroute 192.168.1.1

ADDRESS RT1 RT2 RT3 STATUS

1 192.168.2.2 1ms 1ms 1ms network unreach…
2 192.168.2.2 1ms 1ms 0ms network unreach…

[PC2] > ping 192.168.1.1
HOST SIZE TTL TIME STATUS
192.168.2.2 84 64 0ms net unreachable
192.168.2.2 84 64 0ms net unreachable

[PC2] > ping 192.168.1.11
HOST SIZE TTL TIME STATUS
192.168.2.2 84 64 0ms net unreachable
192.168.2.2 84 64 0ms net unreachable

And SA`s didnt created on Mikrotiks, remote peers also were clear

15

Please post whole “/export compact” from both Mikrotiks.

16 



[admin@MT1] > export compact 
# nov/11/2012 19:14:40 by RouterOS 5.21
# software id = LNA6-2PWP
#
/interface ethernet
set 0 name="ether1 lan1"
set 1 arp=proxy-arp name="ether2 wan"
/tool user-manager customer
add backup-allowed=yes disabled=no login=admin password="" paypal-accept-pending=no paypal-allowed=no paypal-secure-response=no permissions=\
    owner signup-allowed=no time-zone=-00:00
/ip address
add address=10.0.0.1/24 interface="ether2 wan"
add address=192.168.1.1/24 interface="ether1 lan1"
/ip firewall filter
add chain=input dst-port=500 protocol=udp
add chain=input dst-port=4500 protocol=udp
add chain=input protocol=ipsec-esp
add chain=input dst-port=8291 protocol=tcp
add chain=input connection-state=established
add chain=input connection-state=related
add chain=forward connection-state=established
add chain=forward connection-state=related
add chain=input
add chain=forward
add chain=output
/ip firewall nat
add chain=srcnat dst-address=192.168.2.0/24 src-address=192.168.1.0/24
add action=masquerade chain=srcnat out-interface="ether2 wan"
/ip ipsec peer
add address=10.0.0.2/32 dpd-interval=5s dpd-maximum-failures=2 nat-traversal=yes secret=Qwer1234
/ip ipsec policy
add dst-address=192.168.2.0/24 sa-dst-address=10.0.0.2 sa-src-address=10.0.0.1 src-address=192.168.1.0/24 tunnel=yes
/ip neighbor discovery
set "ether1 lan1" disabled=yes
set "ether2 wan" disabled=yes
#error
#error
#error
/system identity
set name=MT1




[admin@MT2] > export compact 
# nov/11/2012 19:15:13 by RouterOS 5.21
# software id = KDKA-N3RK
#
/interface ethernet
set 0 name="ether1 lan2"
set 1 arp=proxy-arp name="ether2 wan"
/tool user-manager customer
add backup-allowed=yes disabled=no login=admin password="" paypal-accept-pending=no paypal-allowed=no paypal-secure-response=no permissions=\
    owner signup-allowed=no time-zone=-00:00
/ip address
add address=10.0.0.2/24 interface="ether2 wan"
add address=192.168.2.2/24 interface="ether1 lan2"
/ip firewall filter
add chain=input dst-port=500 protocol=udp
add chain=input dst-port=4500 protocol=udp
add chain=input protocol=ipsec-esp
add chain=input dst-port=8291 protocol=tcp
add chain=input connection-state=established
add chain=input connection-state=related
add chain=forward connection-state=related
add chain=forward connection-state=established
add chain=input
add chain=output
add chain=forward
/ip firewall nat
add chain=srcnat dst-address=192.168.1.0/24 src-address=192.168.2.0/24
add action=masquerade chain=srcnat out-interface="ether2 wan"
/ip ipsec peer
add address=10.0.0.1/32 dpd-interval=5s dpd-maximum-failures=2 nat-traversal=yes secret=Qwer1234
/ip ipsec policy
add dst-address=192.168.1.0/24 sa-dst-address=10.0.0.1 sa-src-address=10.0.0.2 src-address=192.168.2.0/24 tunnel=yes
/ip neighbor discovery
set "ether1 lan2" disabled=yes
set "ether2 wan" disabled=yes
#error
#error
#error
/system identity
set name=MT2
17

Turn OFF proxy-arp and NAT traversal.

I would reccomend restarting the routers after turning off those, to clear all caches (arp table, SAs, etc)

Other then that, the config is fine. I would guess proxy arp was causing the issues.

18

Nothing has changed

[admin@MT1] > export compact 
file  hide-sensitive
[admin@MT1] > export compact 
# nov/11/2012 20:01:52 by RouterOS 5.21
# software id = LNA6-2PWP
#
/interface ethernet
set 0 name="ether1 lan1"
set 1 name="ether2 wan"
/tool user-manager customer
add backup-allowed=yes disabled=no login=admin password="" paypal-accept-pending=no paypal-allowed=no paypal-secure-response=no permissions=\
    owner signup-allowed=no time-zone=-00:00
/ip address
add address=10.0.0.1/24 interface="ether2 wan"
add address=192.168.1.1/24 interface="ether1 lan1"
/ip firewall filter
add chain=input dst-port=500 protocol=udp
add chain=input protocol=ipsec-esp
add chain=input dst-port=8291 protocol=tcp
add chain=input connection-state=established
add chain=input connection-state=related
add chain=forward connection-state=established
add chain=forward connection-state=related
add chain=input
add chain=forward
add chain=output
/ip firewall nat
add chain=srcnat dst-address=192.168.2.0/24 src-address=192.168.1.0/24
add action=masquerade chain=srcnat out-interface="ether2 wan"
/ip ipsec peer
add address=10.0.0.2/32 dpd-interval=5s dpd-maximum-failures=2 secret=Qwer1234
/ip ipsec policy
add dst-address=192.168.2.0/24 sa-dst-address=10.0.0.2 sa-src-address=10.0.0.1 src-address=192.168.1.0/24 tunnel=yes
/ip neighbor discovery
set "ether1 lan1" disabled=yes
set "ether2 wan" disabled=yes
#error
#error
#error
/system identity
set name=MT1




[admin@MT2] > export compact 
# nov/11/2012 20:02:26 by RouterOS 5.21
# software id = KDKA-N3RK
#
/interface ethernet
set 0 name="ether1 lan2"
set 1 name="ether2 wan"
/tool user-manager customer
add backup-allowed=yes disabled=no login=admin password="" paypal-accept-pending=no paypal-allowed=no paypal-secure-response=no permissions=\
    owner signup-allowed=no time-zone=-00:00
/ip address
add address=10.0.0.2/24 interface="ether2 wan"
add address=192.168.2.2/24 interface="ether1 lan2"
/ip firewall filter
add chain=input dst-port=500 protocol=udp
add chain=input protocol=ipsec-esp
add chain=input dst-port=8291 protocol=tcp
add chain=input connection-state=established
add chain=input connection-state=related
add chain=forward connection-state=related
add chain=forward connection-state=established
add chain=input
add chain=output
add chain=forward
/ip firewall nat
add chain=srcnat dst-address=192.168.1.0/24 src-address=192.168.2.0/24
add action=masquerade chain=srcnat out-interface="ether2 wan"
/ip ipsec peer
add address=10.0.0.1/32 dpd-interval=5s dpd-maximum-failures=2 secret=Qwer1234
/ip ipsec policy
add dst-address=192.168.1.0/24 sa-dst-address=10.0.0.1 sa-src-address=10.0.0.2 src-address=192.168.2.0/24 tunnel=yes
/ip neighbor discovery
set "ether1 lan2" disabled=yes
set "ether2 wan" disabled=yes
#error
#error
#error
/system identity
set name=MT2
19

One more thing you need. You are getting network unreachable ICMP from the routers. How to solve this: as I mentioned before, you dont need routes to oposite side subnets, however, you do need a default route. According to the packet flow diagram, a routing decision is before the IPSec Policy lookup. That is why you are getting ICMP network unreachable, because at the time of a routing decision, packets destined for the other subnet are discarded. Add a default route, it doesnt really have to work, it just needs to be there. At the time of IPSec policy, the packets will be routed properly internally by the router. We need the default route just so the packets are not discarded during the routing decision.

http://wiki.mikrotik.com/wiki/Manual:Packet_Flow

20

May be add provider router?


[admin@Provider] > export compact 
# nov/12/2012 03:11:54 by RouterOS 5.21
# software id = 2984-3G6F
#
/interface ethernet
set 0 name="ether1 wan2"
set 1 name="ether2 wan1"
/tool user-manager customer
add backup-allowed=yes disabled=no login=admin password="" paypal-accept-pending=no paypal-allowed=no paypal-secure-response=no permissions=\
    owner signup-allowed=no time-zone=-00:00
/ip address
add address=10.0.1.254/24 interface="ether2 wan1"
add address=10.0.2.254/24 interface="ether1 wan2"
/system identity
set name=Provider




[admin@MT1] > export compact 
# nov/12/2012 03:12:18 by RouterOS 5.21
# software id = LNA6-2PWP
#
/interface ethernet
set 0 name="ether1 lan1"
set 1 name="ether2 wan1"
/tool user-manager customer
add backup-allowed=yes disabled=no login=admin password="" paypal-accept-pending=no paypal-allowed=no paypal-secure-response=no permissions=\
    owner signup-allowed=no time-zone=-00:00
/ip address
add address=10.0.1.1/24 interface="ether2 wan1"
add address=192.168.1.1/24 interface="ether1 lan1"
/ip firewall filter
add chain=input dst-port=500 protocol=udp
add chain=input protocol=ipsec-esp
add chain=input dst-port=8291 protocol=tcp
add chain=input connection-state=established
add chain=input connection-state=related
add chain=forward connection-state=established
add chain=forward connection-state=related
add chain=input
add chain=forward
add chain=output
/ip firewall nat
add chain=srcnat dst-address=192.168.2.0/24 src-address=192.168.1.0/24
add action=masquerade chain=srcnat out-interface="ether2 wan1"
/ip ipsec peer
add address=10.0.2.2/32 dpd-interval=5s dpd-maximum-failures=2 secret=Qwer1234
/ip ipsec policy
add dst-address=192.168.2.0/24 sa-dst-address=10.0.2.2 sa-src-address=10.0.1.1 src-address=192.168.1.0/24 tunnel=yes
/ip route
add distance=1 gateway=10.0.1.254
#error
#error
#error
/system identity
set name=MT1




[admin@MT2] > export compact 
# nov/12/2012 03:12:35 by RouterOS 5.21
# software id = KDKA-N3RK
#
/interface ethernet
set 0 name="ether1 lan2"
set 1 name="ether2 wan2"
/tool user-manager customer
add backup-allowed=yes disabled=no login=admin password="" \
    paypal-accept-pending=no paypal-allowed=no paypal-secure-response=no \
    permissions=owner signup-allowed=no time-zone=-00:00
/ip address
add address=10.0.2.2/24 interface="ether2 wan2"
add address=192.168.2.2/24 interface="ether1 lan2"
/ip firewall filter
add chain=input dst-port=500 protocol=udp
add chain=input protocol=ipsec-esp
add chain=input dst-port=8291 protocol=tcp
add chain=input connection-state=established
add chain=input connection-state=related
add chain=forward connection-state=related
add chain=forward connection-state=established
add chain=input
add chain=output
add chain=forward
/ip firewall nat
add chain=srcnat dst-address=192.168.1.0/24 src-address=192.168.2.0/24
add action=masquerade chain=srcnat out-interface="ether2 wan2"
/ip ipsec peer
add address=10.0.1.1/32 dpd-interval=5s dpd-maximum-failures=2 secret=\
    Qwer1234
/ip ipsec policy
add dst-address=192.168.1.0/24 sa-dst-address=10.0.1.1 sa-src-address=\
    10.0.2.2 src-address=192.168.2.0/24 tunnel=yes
/ip route
add distance=1 gateway=10.0.2.254
#error
#error
#error
/system identity
set name=MT2