hello i have some time working with mikrotik but recently i made a configuration we have 2 sites connected through a MPLS connection but we want to have a secondary route to the sites through an IPsec VPN, we have an ASA on one site and mikrotik on the other site.
we managed to connected both sites the problem is that when the site with mikrotik has the IPsec enable the MPLS stop working and don’t work till i disable the IPsec tunnel.
is there any way to change the distance of the VPN to make the IPsec VPN secondary and the MPLS connection the main route
The reason is the principle of how IPsec works. When all routing is done completely and the only remaining step is to send the packet out the interface, ipsec policy looks at the packet and if it likes it, it steals it and sends it using its security association.
So you have two possibilities:
use a GRE or IPIP tunnel between the Mikrotik and the ASA which will be encapsulated into IPsec. If both devices are on public addresses and ESP packets don’t disappear mysteriously between the devices (some ISPs filter them, don’t ask me why), the ESP may run in transport mode instead of tunnel one and thus the amount of packet bytes wasted on overhead will be only slightly higher as compared to ESP in tunnel mode without the GRE/IPIP tunnel inside. On top of “normal” routing which uses IP address or interface name as a gateway, this method also permits to use dynamic routing protocols.
create the route with distance=2 via some LAN IP address, and set up netmap (nat of whole subnets) rules in both the srcnat and dstnat chains /ip firewall nat to change the source address of packets with out-interface matching the LAN interface and dst-address not matching the LAN subnet, and modify the IPsec policy to match the netmapped local addresses instead of the real ones. It will only work if the ASA can do a symmetric handling, so it may be easier to netmap the MPLS traffic than the one to be sent via IPsec, but the principle is the same.