IPSec VPN with Dynamic Routing / Mikrotik and Cisco
From MikroTik Wiki
UNDER CONSTRUCTION
First setup Tunnel Interface:
/ interface ipip\ add name="ipip1" mtu=1480 local-address=10.10.1.100 remote-address=10.10.1.200 comment="" disabled=no
Setup IP addresses for interfaces:
/ ip address\ add address=10.10.1.100/24 network=10.10.1.0 broadcast=10.10.1.255 interface=WAN comment="" disabled=no\ add address=192.168.1.1/24 network=192.168.1.0 broadcast=192.168.1.255 interface=LAN comment="" disabled=no\ add address=192.168.0.18/30 network=192.168.0.18 broadcast=192.168.0.18 interface=ipip1 comment="" disabled=no
Enable Routing:
/ routing rip\ set redistribute-static=no redistribute-connected=no redistribute-ospf=no redistribute-bgp=no metric-static=1\ metric-connected=1 metric-ospf=1 metric-bgp=1 \ update-timer=30s timeout-timer=3m garbage-timer=2m\ / routing rip interface\ add interface=Tunnel-1 receive=v2 send=v2 authentication=none authentication-key="" prefix-list-in="" prefix-list-out="" / routing rip neighbor\ add address=172.16.0.17\ / routing rip network\ add address=192.168.1.0/24\ add address=172.16.0.16/30
IPSec setup:
/ ip ipsec policy\ add src-address=10.10.1.100/32:any dst-address=10.10.1.200/32:any protocol=all action=encrypt level=require\ ipsec-protocols=esp tunnel=no \ sa-src-address=10.10.1.100 sa-dst-address=10.10.1.100 proposal=VPN manual-sa=none dont-fragment=clear disabled=no / ip ipsec peer \ add address=10.10.1.200 secret="ipsec" generate-policy=no exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=md5 \ enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no\ / ip ipsec proposal\ add name="IPSec" auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no
Cisco Tunnel Interface:
/interface Tunnel1\ description **Cisco Peer** ip address 192.168.0.17 255.255.255.252 no ip redirects no ip unreachables no ip proxy-arp ip mtu 1480 ip rip v2-broadcast ip tcp adjust-mss 1400 load-interval 30 tunnel source 10.10.1.200 tunnel destination 10.10.1.100 tunnel mode ipip tunnel protection ipsec profile encrypt hold-queue 1024 in hold-queue 1024 out