Community discussions

MikroTik App
 
User avatar
BlackRat
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 97
Joined: Sat Jul 21, 2012 8:37 am

Duplicate ACK in the IPSec tunnel

Wed Nov 03, 2021 8:47 am

Hi.
I have two routers and IPSec tunnel between them.
Windows--NetworkA--RouterA---internet---RouterB--NetworkB--Linux
When I try to ssh from Windows to RouterB (inner interface) all worked nice. I can see full export without issues.
When I try to ssh from Windows to Linux I have an headache, because ssh session breaks in the action. For example when I try to run netstat -na on Linux I see only first several raws. Then ssh-session not worked. I monitored traffic between Windows and Linux and I see duplicated TCP ACK.
What's wrong with IPSec?
RouterB IPSec config
/ip ipsec profile
add dh-group=modp1024 enc-algorithm=aes-128 name=hardware
/ip ipsec peer
add address=RouterA-External name=myipsec profile=hardware
/ip ipsec proposal
add enc-algorithms=aes-128-cbc name=hardware
/ip ipsec identity
add peer=myipsec remote-id=ignore secret=ipsecsecret
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
add dst-address=NetworkA peer=myipsec proposal=hardware src-address=NetworkB tunnel=yes


RouterA IPSec config
/ip ipsec profile
add dh-group=modp1024 enc-algorithm=aes-128 name=hardware-old
/ip ipsec peer
add address=RouterB-external name=myipsec profile=hardware-old
/ip ipsec proposal
add enc-algorithms=aes-128-cbc name=hardware-old
/ip ipsec identity
add peer=myipsec secret=ipsecsecret
/ip ipsec policy
add dst-address=NetworkB peer=myipsec proposal=hardware-old src-address=NetworkA tunnel=yes

Who is online

Users browsing this forum: No registered users and 36 guests