Virtual Subnet Trough Ipsec Tunnel - Mikrotik To Cisco

RouterOS General
1

Good evening everyone
I have problems with an Ipsec.
My configuration is particular and is the following

Location A:
Firewall: Mikrotik On 192.168.1.1
Public Ip: 2.2.2.2
Lan: 192.168.0.0/20

Location B (It is not administered by me, but by another company)
Firewall: Cisco
Public Ip: 3.3.3.3
Lan: 10.11.5.0/24

I have configured the IPSEC correctly.
However, I had to use a virtual subnet in SOURCE ADDRESS because my network 192.168.0.0/20 could not be used as a remote network in the other location, since it was present in other VPNs
Furthermore, from my network I only need to see these two IP addresses of the other network
10.11. 5.179
10.11. 5.194
For the network 10.11. 5.179 I used the virtual subnet 192.168.144.0/20
Subnet set by the other admin on his Cisco

For the network 10.11. 5.194 I used the virtual subnet
Subnet set by the other admin on his Cisco
192.168. 160.0/24

The VPN connection is regularly established and the two phases are correctly processed.
So far so good
Mk1.JPG
Now my problem arises from the fact that from my mikrotik if I launch a ping with both IPSEC active I ping only one IP at a time
Both VPNs are active

Example

[admin@MikroTik] > ping 10.11.5.194 src=192.168.1.1
SEQ HOST SIZE TTL TIME STATUS
0 10.11.5.194 56 64 21ms
1 10.11.5.194 56 64 36ms
2 10.11.5.194 56 64 25ms
3 10.11.5.194 56 64 29ms
4 10.11.5.194 56 64 21ms
5 10.11.5.194 56 64 21ms

[admin@MikroTik] > ping 10.11.5.179 src=192.168.1.1
SEQ HOST SIZE TTL TIME STATUS
0 10.11.5.179 timeout
1 10.11.5.179 timeout
2 10.11.5.179 timeout
3 10.11.5.179 timeout
4 10.11.5.179 timeout

If I disable the other VPN 10.11.5.194 this WORKS and viceversa

[admin@MikroTik] > ping 10.11.5.179 src=192.168.1.1
SEQ HOST SIZE TTL TIME STATUS
0 10.11.5.179 56 64 22ms
1 10.11.5.179 56 64 21ms
2 10.11.5.179 56 64 21ms
3 10.11.5.179 56 64 21ms
4 10.11.5.179 56 64 20ms
5 10.11.5.179 56 64 22ms


I attach the configuration image and the routes configured on the NAT
Mk2.JPG
Mk4.JPG
Mk3.JPG
Mk5.JPG
I report that the problem is mine, there is no problem in Cisco
CISCO 2.png
CISCO 1.png
CISCO 3.png
Any suggestion is welcome

Thanks for your support

2

First of all, change the level parameter of both policies from required to unique. If that does not help, we’ll dig further.

3

Since you’re using the same subnet as someone else on the Cisco side you’ll need to use src-nat. Btw, why not use 192.168.160.0/24 since the Cisco admin already assigned it to you.

4

Good morning everyone
So summary
THE connection is established.
The problem is that the two connections together do not work.
One goes at a time
To access the IP 10.11.5.179 I used the virtual subnet 192.168.144.0/20
To access the IP 10.11.5.194 I used the virtual subnet 192.168.160.0/24
Both subnets were configured on the CISCO (not by me but by an external company)
I set the NAT addresses, but one goes at a time, if one works the other does not.
What can I do?

5

Have you tried following @sindy’s tip? If it doesn’t work, please post a full export of the config:

export file=anynameyouwish (minus senstitve info like public IPs, passwords, etc.)

6

If I set it to REQUIRE A UNIQUE I solve it.
Can you tell me what this entry changes?

7

I may be wrong here, it’s only my own conclusion from observing the behavior, as the desrciption in the manual says something else (or maybe the same but in a pythic wording): if you have two policies between the same peers, require allows to use the same pair of SAs to deliver packets matching to either traffic selector, whereas unique makes sure that for packets matching a given selector, only the SA dedicated to that selector will be used. Since the receiving side also compares received packets to traffic selectors, the approach must be the same at both peers, otherwise the peer that is set to unique drops packets that came via the “wrong” SA.