Community discussions

MUM Europe 2020
just joined
Topic Author
Posts: 22
Joined: Fri Mar 16, 2012 10:52 am

ipsec to cisco-Mikrotik is behind NAT. Tun is up no traffic

Sat Feb 08, 2014 3:04 am

I'm trying to setup an ipsec tunnel to a cisco router.
The mikrotik is connected through a 3G stick and gets a private ip address that is then nat-ed by the provider.

I can see that the tunnel is up and that SA's are established but no traffic goes through.

Please note that when I try the same setup with a 3G stick that gets public IP address everything works fine but I have to get it working with the one that only gets private IP (so Mikrotik is behind NAT).

On the cisco i see:
Obi-Wan#show cry isa sa
dst src state conn-id slot status
195.*.*.* 200.*.*.* QM_IDLE 6 0 ACTIVE

195. is address on cisco and 200. is mikrotik nat-ed address.

On the mikrotik I can see SA's. Source is 10.X.X.X (address mikrotik gets from 3G) and destination is 195.X.X.X (cisco) and
another one source 195.X.X.X and destination 10.X.X.X

In Policies I have SA src address, and SA dst address 195.X.X.X

Can anyone give me some hint how to solve this?

User avatar
Posts: 610
Joined: Sun Feb 14, 2010 11:41 pm
Location: Van, Texas

Re: ipsec to cisco-Mikrotik is behind NAT. Tun is up no traf

Mon Feb 17, 2014 5:38 am

You are going to have to use a VPN that calls home like PPtP. Then your IPSEC tunnel will get established between the private IP addresses of the 1st tunnel. You'll be able to get it to work that way, but you make have to adjust the MTUs depending on which tunnel combination you use.
Launch your company forward with professional training! ... raining-2/

Who is online

Users browsing this forum: Rey68 and 127 guests