http://mikrotik.moscow Новое в теме Не получается установить IPSEC туннель. форума RouterOS на сайте Mikrotik.moscow [mikrotik.moscow] ru http://backend.userland.com/rss2 Mon, 10 Aug 2026 19:36:29 -0400 Не получается установить IPSEC туннель. RouterOS в форуме RouterOS.
Когда мы пытаемся построить IPSEC туннель между двумя сетями за Mikrotik роутером, установленная SA имеет отсутствующее поле ‘direction=out’ на одной стороне, в то время как на удаленной стороне есть Installed SAs как для in, так и для out. Пакеты могут путешествовать в одном направлении без проблем, но на обратном пути они отбрасываются политикой в ‘Out dropped’. Mikrotik ver. 2.9.10 [router #1 ] ip ipsec policy> export / ip ipsec policy add src-address=172.31.255.0/24:any dst-address=192.168.0.0/24:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=1.1.1.1 sa-dst-address=2.2.2.2 proposal=default manual-sa=none dont-fragment=clear disabled=no / ip ipsec peer add address=2.2.2.2/32:500 secret=“P4uf7xTH” generate-policy=no exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no / ip ipsec proposal add name=“default” auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no [router #1 ] ip ipsec installed-sa> print 0 E spi=0x62738F04 direction=in src-address=2.2.2.2 dst-address=1.1.1.1 auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature auth-key=“94b2e28ab865ffbd7fdc2763d57639af” enc-key=“fc7db5e157dabfe81723c9605504a364f48d588b393685f1” add-lifetime=24m/30m use-lifetime=0s/0s lifebytes=0/0 current-addtime=jan/24/2006 17:33:29 current-usetime=jan/01/1970 00:00:00 current-bytes=0 [router #2 ] ip ipsec policy> export / ip ipsec policy add src-address=192.168.0.0/24:any dst-address=172.31.255.0/24:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=2.2.2.2 sa-dst-address=1.1.1.1 proposal=default manual-sa=none dont-fragment=clear disabled=no / ip ipsec peer add address=1.1.1.1/32:500 secret=“P4uf7xTH” generate-policy=no exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no / ip ipsec proposal add name=“default” auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no [router #2 ] ip ipsec installed-sa> print 0 E spi=0x62738F04 direction=out src-address=2.2.2.2 dst-address=1.1.1.1 auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature auth-key=“94b2e28ab865ffbd7fdc2763d57639af” enc-key=“fc7db5e157dabfe81723c9605504a364f48d588b393685f1” add-lifetime=24m/30m use-lifetime=0s/0s lifebytes=0/0 current-addtime=jan/24/2006 17:33:29 current-usetime=jan/01/1970 00:00:00 current-bytes=0 1 E spi=0x8EC0EF05 direction=in src-address=1.1.1.1 dst-address=2.2.2.2 auth-algorithm=md5 enc-algorithm=3des replay=4 state=mature auth-key=“95ee51b1e831b24a5b092d68cefa522e” enc-key=“096945f5a5cc44cca7526b22d023640a3b71b70661185155” add-lifetime=24m/30m use-lifetime=0s/0s lifebytes=0/0 current-addtime=jan/24/2006 17:33:29 current-usetime=jan/01/1970 00:00:00 current-bytes=0
24.01.2006 18:24:00, gosha.]]> http://mikrotik.moscow/forum/forum57/64700-ne-poluchaetsya-ustanovit-ipsec-tunnel./message250193 http://mikrotik.moscow/forum/forum57/64700-ne-poluchaetsya-ustanovit-ipsec-tunnel./message250193 Tue, 24 Jan 2006 18:24:00 -0500 RouterOS