Hi there,
i trying to establish a side to side tunnel with an mikrotik ccr1009 as zentral unit and an component from another reseller as dezentral unit.
If i configure the phase 1 to sha1 everything works fine! But if i change the settings to sha256 for phase1 i get in the mikrotik log the following output:

No suitable proposal found.
10.20.13.xxx failed to get vaild proposal
....

Any ideas whats wrong here? If i use sha1 in phase1 i can use sha256 in phase2 that works, but not in phase1.
Thanks!
Kind regards

You need to set sha256 for phase1 on both ends, not just on CCR.

Yes,
thats what i have done, but it still not working.
I currently try it again but it won't work. if i change the settings for phase1 one both devices to sha1/aes128/dh1024 everythink works great and then i can use for phase2 sha256/aes256/dh4096.

But phase1 did not work.

enable ipsec debug logs, there you should be able to see what exactly remote peer is expecting.
Also which RouterOS version you are running?

Hi,
i am running currently 6.43rc4 on the ccr.
Instead i try it with another vendor router as dezentral device and it happens the same thing. so there must be anything wrong with my ccr.

I added an screenshot from the ipsec logs

If you are using winbox then there is a bug in RC version that does not set phase1 correctly. Use terminal to change settings.

Thanks for your really really quick help!
That fixed my issue, any idea how i can fix that to contiune working with winbox?

Thanks!
Kind regards

That requires software fix which we intend to fix in future versions.
You can downgrade to 6.42 current, if you intend to use winbox.

Thats a great idea, security vulnerabilities are also fixed in the stable branche or?
Could i simply downgrade as upgrade?

THanks