Community discussions

MikroTik App
  4. RouterOS
  5. General

Problem with ipsec tunnel to Cisco ASA

Post Reply
 
jfulton
just joined
Topic Author
Posts: 1
Joined: Tue Apr 30, 2024 11:07 pm

Problem with ipsec tunnel to Cisco ASA

Wed May 01, 2024 1:17 am

I have a tunnel up and working with a Cisco ASA. I have 57 phase 2 policies built as it interconnects 19 cell sites back to 3 networks each to the cell partner.
It works perfectly fine the first network I communicate across. The second network doesn't work until I disable and enable the policy. But then the first policy quits working. It shows active but quits passing traffic. It seems only one policy is operational at a time. I've even ripped out the firewall config to try to eliminate as much extraneous config as possible.

This is on a CCR1036-12G-4S running 7.14.3
Code: Select all
/ip ipsec profile
add dh-group=modp1024 enc-algorithm=aes-256,aes-192,aes-128 name=XXXX-Profile
/ip ipsec peer
add address=xx.xx.xx.xx/32 local-address=xx.xx.xx.xx name=XXXX-Peer profile=XXXX-Profile
/ip ipsec proposal
set [ find default=yes ] disabled=yes
add lifetime=1h name=XXXX-Proposal pfs-group=none
/ip firewall raw
add action=notrack chain=prerouting ipsec-policy=in,ipsec
add action=notrack chain=output ipsec-policy=out,ipsec
/ip ipsec identity
add peer=XXXX-Peer
/ip ipsec policy
set 0 disabled=yes
add dst-address=10.185.3.0/27 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.51.8/30 tunnel=yes
add dst-address=10.185.4.0/27 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.51.8/30 tunnel=yes
add dst-address=10.128.10.0/25 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.61.8/30 tunnel=yes
add dst-address=10.185.3.0/27 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.51.12/30 tunnel=yes
add dst-address=10.185.4.0/27 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.51.12/30 tunnel=yes
add dst-address=10.128.10.0/25 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.61.12/30 tunnel=yes
add dst-address=10.185.3.0/27 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.51.20/30 tunnel=yes
add dst-address=10.185.4.0/27 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.51.20/30 tunnel=yes
add dst-address=10.128.10.0/25 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.61.20/30 tunnel=yes
add dst-address=10.185.3.0/27 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.51.24/30 tunnel=yes
add dst-address=10.185.4.0/27 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.51.24/30 tunnel=yes
add dst-address=10.128.10.0/25 peer=XXXX-Peer proposal=XXXX-Proposal src-address=10.128.61.24/30 tunnel=yes
... (57 policies in total)
Last edited by tangent on Wed May 01, 2024 4:55 am, edited 1 time in total.
Reason: Converted quote to code block
Top
 
User avatar
vingjfg
Member
Member
Posts: 344
Joined: Fri Oct 20, 2023 1:45 pm

Re: Problem with ipsec tunnel to Cisco ASA

Wed May 01, 2024 7:30 am

Can you send the output of
Code: Select all
show crypto ipsec sa
On the asa?
Top
 
abbio90
Member Candidate
Member Candidate
Posts: 253
Joined: Fri Aug 27, 2021 9:16 pm
Contact:
Contact abbio90

Re: Problem with ipsec tunnel to Cisco ASA

Sat May 04, 2024 12:09 am

I follow with interest
Top
 
RiFF
newbie
Posts: 36
Joined: Sun Apr 29, 2018 9:35 pm

Re: Problem with ipsec tunnel to Cisco ASA

Mon May 06, 2024 3:42 pm

This option should help you - https://help.mikrotik.com/docs/display/ ... e%20packet
You have to enable it on all Policies to Peer (level - unique)
Top
Post Reply

Who is online

Users browsing this forum: eworm, fje, gotsprings, Idontknow, Magvegva and 40 guests
  4. RouterOS
  5. General