Когда мы пытаемся построить IPSEC туннель между двумя сетями за Mikrotik роутером, установленная SA имеет отсутствующее поле ‘direction=out’ на одной стороне, в то время как на удаленной стороне есть Installed SAs как для in, так и для out. Пакеты могут путешествовать в одном направлении без проблем, но на обратном пути они отбрасываются политикой в ‘Out dropped’. Mikrotik ver. 2.9.10 [router #1 ] ip ipsec policy> export / ip ipsec policy add src-address=172.31.255.0/24:any dst-address=192.168.0.0/24:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=1.1.1.1 sa-dst-address=2.2.2.2 proposal=default manual-sa=none dont-fragment=clear disabled=no / ip ipsec peer add address=2.2.2.2/32:500 secret=“P4uf7xTH” generate-policy=no exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no / ip ipsec proposal add name=“default” auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no [router #1 ] ip ipsec installed-sa> print 0 E spi=0x62738F04 direction=in src-address=2.2.2.2 dst-address=1.1.1.1 auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature auth-key=“94b2e28ab865ffbd7fdc2763d57639af” enc-key=“fc7db5e157dabfe81723c9605504a364f48d588b393685f1” add-lifetime=24m/30m use-lifetime=0s/0s lifebytes=0/0 current-addtime=jan/24/2006 17:33:29 current-usetime=jan/01/1970 00:00:00 current-bytes=0 [router #2 ] ip ipsec policy> export / ip ipsec policy add src-address=192.168.0.0/24:any dst-address=172.31.255.0/24:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=2.2.2.2 sa-dst-address=1.1.1.1 proposal=default manual-sa=none dont-fragment=clear disabled=no / ip ipsec peer add address=1.1.1.1/32:500 secret=“P4uf7xTH” generate-policy=no exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no / ip ipsec proposal add name=“default” auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no [router #2 ] ip ipsec installed-sa> print 0 E spi=0x62738F04 direction=out src-address=2.2.2.2 dst-address=1.1.1.1 auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature auth-key=“94b2e28ab865ffbd7fdc2763d57639af” enc-key=“fc7db5e157dabfe81723c9605504a364f48d588b393685f1” add-lifetime=24m/30m use-lifetime=0s/0s lifebytes=0/0 current-addtime=jan/24/2006 17:33:29 current-usetime=jan/01/1970 00:00:00 current-bytes=0 1 E spi=0x8EC0EF05 direction=in src-address=1.1.1.1 dst-address=2.2.2.2 auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature auth-key=“95ee51b1e831b24a5b092d68cefa522e” enc-key=“096945f5a5cc44cca7526b22d023640a3b71b70661185155” add-lifetime=24m/30m use-lifetime=0s/0s lifebytes=0/0 current-addtime=jan/24/2006 17:33:29 current-usetime=jan/01/1970 00:00:00 current-bytes=0
