<div dir="ltr">Hello,<div><br><div><div>I am trying to make a tunnel between </div><div><div>Linux Openswan U2.6.23/K2.6.32-50-generic-pae (netkey)</div></div><div>and RouterOS 6.11</div><div>they are connected as follows:</div>
<div>LAN <a href="http://192.168.20.0/24===[">192.168.20.0/24===[</a> 88.888.8.88 OPENSWAN ] ...INTERNET... [ 77.777.77.7 ROUTEROS ]===<a href="http://192.168.17.0/24">192.168.17.0/24</a> LAN;</div><div><br></div><div>here's what I see on linux box</div>
<div># ipsec auto --status</div><div>"md-ene-mikrotik":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 1340s; newest ISAKMP; lastdpd=70s(seq in:0 out:0); idle; import:not set<br></div><div>
<br></div><div>on mikrotik I also see</div><div>> ip ipsec remote-peers print</div><div> 0 local-address=77.777.77.7 remote-address=88.888.8.88 state=established side=initiator established=38m5s <br></div><div><br></div>
<div>so the first phase goes right</div><div><div><br></div><div>but I see no sa-installed on microtic</div><div>[admin@MikroTik] > ip ipsec installed-sa print</div></div><div><br></div><div># ip xfrm state</div><div>gives nothing</div>
<div><br></div><div><br></div><div>below are the settings on both sides, let me know if more info is needed</div><div>by the way, there is one more tunnel between this mikrotik and another one, works fine.</div><div>Thanks!</div>
<div><br></div><div>here's my /etc/ipsec.conf</div><div><br></div><div><div>config setup</div><div> virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12</a></div>
<div> oe=off</div><div> protostack=netkey</div><div><br></div><div>conn md-ene-mikrotik</div><div> esp=3des-sha1</div><div> ike=3des-md5-modp1024</div><div> authby=secret</div><div> keylife=28800s</div>
<div> left=88.888.8.88</div><div> leftsubnet=<a href="http://192.168.20.0/24">192.168.20.0/24</a></div><div> leftsourceip=192.168.20.1</div><div> right=77.777.77.7</div><div> rightsubnet=<a href="http://192.168.17.0/24">192.168.17.0/24</a></div>
<div> rightsourceip=192.168.17.1</div><div> auto=add</div><div> type=tunnel</div><div> pfs=no</div></div><div><br></div></div></div><div>here's mikrotik conf</div><div>> ip ipsec peer print</div><div><div>
1 address=88.888.8.88/32 local-address=0.0.0.0 passive=no port=500 auth-method=pre-shared-key secret="cthdbc" generate-policy=no exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=md5 enc-algorithm=3des </div>
<div> dh-group=modp1024 lifetime=1d lifebytes=0 dpd-interval=2m dpd-maximum-failures=5 </div></div><div><br></div><div>> ip ipsec policy print</div><div> 1 src-address=<a href="http://192.168.17.0/24">192.168.17.0/24</a> src-port=any dst-address=<a href="http://192.168.20.0/24">192.168.20.0/24</a> dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=77.777.77.7 sa-dst-address=88.888.8.88 proposal=proposal1 priority=0 </div>
<div><br></div><div>> ip ipsec proposal print</div><div><div> 1 name="proposal1" auth-algorithms=sha1 enc-algorithms=3des lifetime=8h pfs-group=modp1024 </div></div><div><br></div><div><br></div></div>