Two ipsec connections from one ip to mikrotik with multiwan

Jukilo · Thu Apr 04, 2019 3:42 pm

Sorry for my english, i know it's so badly...

I have two mikrotik, first have one isp and works like ipsec initiator, second works like ipsec responder. I wand install two ipsec connections, but it's don't work. Single ipsec connections are work< but two at same time is no...

Lab scheme and configs:

ros-ipsec.png

Mikrotik1(init):

/ip ipsec peer profile
add dh-group=modp1024 enc-algorithm=des name=Test-P1
/ip ipsec policy group
add name=Test
/ip ipsec proposal
add enc-algorithms=des name=Test-P2
/ip address
add address=1.1.1.1/24 interface=ether1 network=1.1.1.0
/ip ipsec peer
add address=2.2.2.2/32 exchange-mode=ike2 policy-template-group=Test profile=Test-P1 secret=test123
add address=3.3.3.3/32 exchange-mode=ike2 policy-template-group=Test profile=Test-P1 secret=test123
/ip route
add distance=1 gateway=1.1.1.254
/system package update
set channel=long-term

Mikrotik2(dual wan, resp):

/ip ipsec peer profile
add dh-group=modp1024 enc-algorithm=des name=Test-P1
/ip ipsec policy group
add name=Test
/ip ipsec proposal
add enc-algorithms=des name=Test-P2
/caps-man manager
set enabled=yes
/interface wireless cap
set caps-man-addresses=127.0.0.1 interfaces=wlan1
/ip address
add address=2.2.2.2/24 interface=ether1 network=2.2.2.0
add address=3.3.3.3/24 interface=ether2 network=3.3.3.0
/ip ipsec peer
add address=0.0.0.0/0 exchange-mode=ike2 generate-policy=port-strict passive=yes policy-template-group=Test profile=Test-P1 secret=test123 send-initial-contact=no
/ip ipsec policy
add dst-address=0.0.0.0/0 group=Test proposal=Test-P2 protocol=udp src-address=0.0.0.0/0 template=yes
/ip route
add check-gateway=ping distance=1 gateway=2.2.2.254 routing-mark=isp1
add check-gateway=ping distance=1 gateway=3.3.3.254 routing-mark=isp2
add check-gateway=ping distance=1 gateway=2.2.2.254
add check-gateway=ping distance=2 gateway=3.3.3.254
/ip route rule
add action=lookup-only-in-table src-address=2.2.2.2/32 table=isp1
add action=lookup-only-in-table src-address=3.3.3.3/32 table=isp2
/system package update
set channel=long-term

sindy · Sat Apr 06, 2019 6:32 pm

What I normally do is that on the responder end, I configure two peers with distinct local-address settings, and make sure that the route to the initiator takes into account the local source address (which is what your /ip route rule items do) or that the connections are marked to stick responses to incoming connections on those interfaces through which the initial request came (so you would be assigning the routing-mark based on connection-mark rather than on the source address). Second, I use the xauth mode so that the responder doesn't identify the initiator by its IP address but by its xauth user name. It is possible that just one of (xauth mode, two peers) is necessary but I hazily remember I needed both.

Jukilo · Wed Apr 17, 2019 1:04 am

Thanx, i will try to config with xauth and write about the result

sindy · Wed Apr 17, 2019 9:01 am

Before doing that, follow the advice and explanation of Mikrotik support's IPsec expert @emils in this almost identical thread.

And I have to apologize for misleading you - in my setups it is actually always the initiator which has two WANs, so the intuitive (and wrong) understanding of the purpose of the send-initial-contact=no as something just preventing the peer from actively initiating the establishment of the IKEv2 SA doesn't prevent the setup from working because in my cases, I do have this setting on responder side (activated using passive=yes) which is also the side where a common IP address is used for both IPsec "sessions".

Two ipsec connections from one ip to mikrotik with multiwan

Two ipsec connections from one ip to mikrotik with multiwan

Re: Two ipsec connections from one ip to mikrotik with multiwan

Re: Two ipsec connections from one ip to mikrotik with multiwan

Re: Two ipsec connections from one ip to mikrotik with multiwan

Who is online