Issue with S2S VPN between Cisco and Mikrotik

[Ivane Sajaia]

Hello,

I have issue regarding Crypto map VPN between cisco ISR 4433 router and Mikrotik Router..

Issue is that Phase 2 is not up...

Relevant config

crypto isakmp profile IKEV1_PROFILE_CRYPTOMAP
vrf SILK
keyring IKEv1_KEYRING1
match identity address XX.XX.XX.XX 255.255.255.255

crypto keyring IKEv1_KEYRING1 vrf VRF

 pre-shared-key address XX.XX.XX.XX key 

crypto map CRYPTO_VRF 2 ipsec-isakmp
set peer XX.XX.XX.XX
set transform-set ESP-AES256-SHA256
set pfs group14
set isakmp-profile IKEV1_PROFILE_CRYPTOMAP
match address CRYPTOMAP
reverse-route

Below is output of debug crypto ipsec 

May 11 2022 13:50:00.957 TBS: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= CISCO_PUBLIC_IP:0, remote= MIKROTIK_PUBLIC_IP:0,
    local_proxy= 10.11.11.11/255.255.255.255/256/0,
    remote_proxy= 10.11.11.15/255.255.255.255/256/0,
    protocol= ESP, transform= esp-aes 256 esp-sha256-hmac  (Tunnel), esn= FALSE,
    lifedur= 0s and 0kb, 
    spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x0
May 11 2022 13:50:00.957 TBS: Crypto mapdb : proxy_match
        src addr     : 10.11.11.11
        dst addr     : 10.11.11.15
        protocol     : 0
        src port     : 0
        dst port     : 0
May 11 2022 13:50:00.958 TBS: Crypto mapdb : proxy_match
        src addr     : 10.11.11.11
        dst addr     : 10.11.11.15
        protocol     : 0
        src port     : 0
        dst port     : 0
May 11 2022 13:50:00.958 TBS: IPSEC(ipsec_process_proposal): peer address MIKROTIK_PUBLIC_IP not found
May 11 2022 13:50:00.959 TBS: IPSEC(crypto_ipsec_validate_proposal_request): duplicate/invalid transform requested: prot 3, trans 13, hmac 5
May 11 2022 13:50:00.960 TBS: IPSEC(crypto_ipsec_validate_proposal_request): duplicate/invalid transform requested: prot 3, trans 13, hmac 5
May 11 2022 13:50:00.961 TBS: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= CISCO_PUBLIC_IP:0, remote= MIKROTIK_PUBLIC_IP:0,
    local_proxy= 10.11.11.11/255.255.255.255/256/0,
    remote_proxy= 10.11.11.15/255.255.255.255/256/0,
    protocol= ESP, transform= esp-gcm 256  (Tunnel), esn= FALSE,
    lifedur= 0s and 0kb, 
    spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x0
May 11 2022 13:50:00.961 TBS: Crypto mapdb : proxy_match
        src addr     : 10.11.11.11
        dst addr     : 10.11.11.15
        protocol     : 0
        src port     : 0
        dst port     : 0
May 11 2022 13:50:00.961 TBS: Crypto mapdb : proxy_match
        src addr     : 10.11.11.11
        dst addr     : 10.11.11.15
        protocol     : 0
        src port     : 0
        dst port     : 0
ROUTER#
May 11 2022 13:50:00.961 TBS: IPSEC(ipsec_process_proposal): peer address MIKROTIK_PUBLIC_IP not found
May 11 2022 13:50:00.962 TBS: IPSEC(crypto_ipsec_validate_proposal_request): duplicate/invalid transform requested: prot 3, trans 20, hmac 0

[balaji.bandi]

May 11 2022 13:50:00.958 TBS: IPSEC(ipsec_process_proposal): peer address MIKROTIK_PUBLIC_IP not found
May 11 2022 13:50:00.959 TBS: IPSEC(crypto_ipsec_validate_proposal_request): duplicate/invalid transform requested: prot 3, trans 13, hmac 5
May 11 2022 13:50:00.960 TBS: IPSEC(crypto_ipsec_validate_proposal_request): duplicate/invalid transform requested: prot 3, trans 13, hmac 5

i would revisit the config :

https://www.youtube.com/watch?v=JsUgRvOWMe8

https://www.youtube.com/watch?v=UZu6cfr8RGM

[Ivane Sajaia]

See the thing is that, they definitely see each other because phase 1 is up, i too believe it is somehow a configuration issue but since vrf is also included in this, its not so clear and i was looking for configuration confirmation too? if thats possible... i checked cisco vrf aware ipsec guide and did this config according to that but it is currently failing...

[Rob Ingram]

@Ivane Sajaia

The source IP address is 10.11.11.11 and destination IP is in the same network (10.11.11.15), is that correct?

Provide the configuration of your ACL CRYPTOMAP., this needs to be mirrored on the remote mikrotik end.

Provide some information on the configuration of the remote mikrotik device.

[Ivane Sajaia]

Hi 

Heres Cisco ACL

10 permit ip host 10.11.11.11 host 10.11.11.15

Heres Mikrotik Policy

#    PEER   TUNNEL  SRC-ADDRESS     DST-ADDRESS     PROTOCOL  ACTION   LEVEL    PH2-COUNT
0    peer1  yes     10.11.11.15/32  10.11.11.11/32  all       encrypt  require          0

[Sheraz.Salim]

since you phase 1 is coming up it has to be the config issue. double check your phase 2 setting are matching on both sides.

[Ivane Sajaia]

I did double triple check it, but i cant seem to find issue and i cant figure out what this error log is pointing to... like if it cant find peer that should be problem in crypto map peer configuration no? but it is correct

[MHM Cisco World]

It seem to me one side is behind NAT 

so instead config set peer "real IP" change it to be set peer "mapped IP".

[Ivane Sajaia]

Hi,

if that was the case, would phase 1 be up?

also i have access to mikrotik and it has static public ip

[MHM Cisco World]

Yes phase1 is UP but phase2 that check the remote-ID is down, 
so either the remote is behind NAT and set peer is misconfig 
or NAT-T is not enable.