Remote end of ipsec tunnel not responding

Hi

I have just setup an ipsec tunnel between and Mikrotik RB951G and a Cisco ASA 5505
using SHA hash algo and 3DES encryption

I followed the following presentation: http://wiki.mikrotik.com/wiki/MikroTik_router_to_CISCO_PIX_Firewall_IPSEC

The tunnel seems to be up, I have SAs for both directions, though only one has current bytes (RB => Cisco) and the info appearing in the ipsec log seems pretty positive

I have pinged a host that is present on the remote LAN, but get I no response, it just times'out

What I can't figure out is how do my packets know how to get to the remote LAN ?
I haven't created a explicit route; only the ipsec policy knows of the association between our two LANs
I don't know how I would create such a route because I don't have an 'ipsec' interface to point to

any ideas
thanks
yann
Yann ShukorOwnerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AkinsdNetwork AdministratorCommented:
I think you just answered your own question.

Check your routes, NAT and ACL settings.
Usually, traffic destined for VPN need to be excluded from NAT
A traceroute or packet-trace on the ASA will show you the path the traffic is taking
0
Yann ShukorOwnerAuthor Commented:
I indeed have a rule which excludes traffic between the two LANs from being NATed
Traceroute from my end (Mikrotik) doesn't get any further than the router
0
AkinsdNetwork AdministratorCommented:
Traceroute from my end (Mikrotik) doesn't get any further than the router
A set of  asterixs (***********) would mean the traffic is blocked (ACL issue)
A destination unreachable would indicate the router doesn't know where to send the traffic (Route issue)
ICMP Traffic (especially a traceroute - type 8) through VPN would not display past the VPN entry point (meaning your setup is correct, but the ASA is not responding).

If Mikrltiks have packet-trace feature, then try that or have the engineer on the other end run a detailed packet-trace from the ASA
0
Turn Raw Data into a Real Career

There’s a growing demand for qualified analysts who can make sense of Big Data. With an MS in Data Analytics, you can become the data mining, management, mapping, and munging expert that today’s leading corporations desperately need.

Yann ShukorOwnerAuthor Commented:
I'll have to wait till my customer is present to check whether his LAN knows how to reach my LAN

The question remains though: how do I create a route to my client's LAN ?
I can't point it at an IPSEC interface, because there isn't one
I tried to point it at my router's WAN IP address but that didn't work: unreachable, then at my routers WAN interface : but the pings still don't get any responses
0
Pete LongTechnical ConsultantCommented:
As pointed out sounds more like a phase 2 problem, if you have esablished SA, and can see bytes moving, then usually one of the sections (bytes encaps or decaps) will be at Zero. this points you to the physical location of the problem, see Troubleshooting Phase 2 Cisco Site to Site (L2L) VPN Tunnels

P
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Yann ShukorOwnerAuthor Commented:
In fact it was my Orange Livebox which was preventing the VPN
from functionning correctly (even with rule allowing port 500
and 4500)  
I used my other WAN uplink (which uses another router) and
the VPN hooked up straight away allowing my pings through
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.