Multiple access list site to site vpn get "IPSEC ERROR: Failed to send the message to IKE"

[am1r007]

I have set up site to site vpn between asa 5508 and mikrotik. Everything is fine when  I use only one access list. I got the problem when i add some access list to crypto map.  In debug I got massage "IPSEC ERROR: Failed to send the message to IKE".

here is my access list:

access-list client_traffic extended permit ip 192.168.21.34 255.255.255.255 192.168.33.105 255.255.255.255
access-list client_traffic extended permit ip 192.168.21.35 255.255.255.255 192.168.33.44 255.255.255.255
access-list client_traffic extended permit ip 192.168.21.35 255.255.255.255 192.168.33.45 255.255.255.255
access-list client_traffic extended permit ip 192.168.21.35 255.255.255.255 192.168.33.46 255.255.255.255
access-list client_traffic extended permit ip 192.168.21.35 255.255.255.255 192.168.33.47 255.255.255.255
access-list client_traffic extended permit ip 192.168.21.35 255.255.255.255 192.168.33.67 255.255.255.255
access-list client_traffic extended permit ip 192.168.21.34 255.255.255.255 192.168.33.67 255.255.255.255
access-list client_traffic extended permit icmp 192.168.17.165 255.255.255.255 192.168.10.1 255.255.255.255

i use asa cversion 9.8(2).

Thanks for advice

[Marius Gunnerud · Accepted solution]

Sounds like the Microtik is uses route based VPN which causes the VPN to setup a new tunnel for each subnet, while ASA sends all subnets through the same tunnel.

"Setting Mikrotik IPSec Policy with the ‘require’ level (default option) causes the router to create a single SA with the remote peer."

ref:

https://blog.bravi.org/?p=1209

[am1r007]

Great!!!!
Thanks
You've healed my a week headache. :)