Community discussions

User avatar
just joined
Topic Author
Posts: 6
Joined: Mon Dec 04, 2017 3:05 am
Location: Canada

IPSec behind DMZ Double NAT Problem

Fri Dec 15, 2017 7:25 pm


I'm new to Mikrotik forgive my ignorance but I'm having some difficulty setting up IPSec tunnel tests before my CRR1009 goes live at the DC. Testing with a CRR1009-7G-1C-1S+ Office2 <==> Office3 hEX RB750Gr3. My goal would be then to setup Admin accounts to the DC with each using a hEX RB750Gr3. All Mikrotiks are using v6.40.5.

From Local (Office2)
IPSec debug states sendfromto failed
(phase 1 negotiation failed due to send error)
17:31:24 ipsec,info initiate new phase 1 (Identity Protection):[500]<=>[500] 
17:31:24 ipsec,debug new cookie: 
17:31:24 ipsec,debug 2f03b2dd9a7a0d7e  
17:31:24 ipsec,debug add payload of len 56, next type 13 
17:31:24 ipsec,debug add payload of len 16, next type 13 
17:31:24 ipsec,debug add payload of len 16, next type 0 
17:31:24 ipsec,debug 128 bytes from[500] to[500] 
17:31:24 ipsec,debug 1 times of -1 bytes message will be sent to[500] 
17:31:24 ipsec,debug,packet 2f03b2dd 9a7a0d7e 00000000 00000000 01100200 00000000 00000080 0d00003c 
17:31:24 ipsec,debug,packet 00000001 00000001 00000030 01010001 00000028 01010000 800b0001 000c0004 
17:31:24 ipsec,debug,packet 00015180 80010007 800e0100 80030001 80020004 80040002 0d000014 12f5f28c 
17:31:24 ipsec,debug,packet 457168a9 702d9fe2 74cc0100 00000014 afcad713 68a1f1c9 6b8696fc 77570100 
17:31:24 ipsec sendfromto failed 
17:31:24 ipsec,error phase1 negotiation failed due to send error.[500]<=>[500] 2f03b2dd9a7a0d7
17:31:24 ipsec failed to begin ISAKMP SA negotiation

name="office" auth-algorithms=sha256 enc-algorithms=aes-256-cbc lifetime=30m pfs-group=modp1024

address= local-address= auth-method=pre-shared-key secret="" generate-policy=no policy-template-group=default 
       exchange-mode=main send-initial-contact=yes nat-traversal=no proposal-check=obey hash-algorithm=sha256 enc-algorithm=aes-256 dh-group=modp1024 lifetime=1d 

src-address= src-port=any dst-address= dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes 
       sa-src-address= sa-dst-address= proposal=default ph2-count=0

Action: netmap Chain: dstnat works fine while testing port forwards from external. I have tested several local IP nets on different Ether Interfaces and several port forwards to each using destination add of which is the DMZ and this all works as expected. Is there a way to get around the double NAT at the Office2 in order to get IPSec up? I have disabled fasttrack connection forward as very little CPU usage at the moment.
Last edited by icttech on Sun Oct 28, 2018 4:20 pm, edited 3 times in total.
just joined
Posts: 6
Joined: Sun Dec 15, 2013 8:51 pm

Re: IPSec behind DMZ Double NAT Problem

Fri Nov 09, 2018 8:06 pm


This is marked as solved, but I can't see any details as solved..

Who is online

Users browsing this forum: Frostbyte, Kindis, TurboCow and 36 guests