IPSec VPN with Dynamic Routing / Mikrotik and Cisco

From MikroTik Wiki
Revision as of 12:09, 2 October 2007 by Fatonk (talk | contribs)
Jump to: navigation, search

UNDER CONSTRUCTION

First setup Tunnel Interface:

   / interface ipip\ 
   add name="ipip1" mtu=1480 local-address=10.10.1.100 remote-address=10.10.1.200 comment="" disabled=no

Setup IP addresses for interfaces:

   / ip address\
   add address=10.10.1.100/24 network=10.10.1.0 broadcast=10.10.1.255 interface=WAN comment="" disabled=no\ 
   add address=192.168.1.1/24 network=192.168.1.0 broadcast=192.168.1.255 interface=LAN comment="" disabled=no\ 
   add address=192.168.0.18/30 network=192.168.0.18 broadcast=192.168.0.18 interface=ipip1 comment="" disabled=no

Enable Routing:

  / routing rip\ 
  set redistribute-static=no redistribute-connected=no redistribute-ospf=no redistribute-bgp=no metric-static=1\ 
  metric-connected=1  metric-ospf=1 metric-bgp=1 \
  update-timer=30s timeout-timer=3m garbage-timer=2m\ 
  / routing rip interface\ 
  add interface=Tunnel-1 receive=v2 send=v2 authentication=none authentication-key="" prefix-list-in="" prefix-list-out="" 
  / routing rip neighbor\ 
  add address=172.16.0.17\ 
  / routing rip network\ 
  add address=192.168.1.0/24\ 
  add address=172.16.0.16/30

IPSec setup:

  / ip ipsec policy\ 
  add src-address=10.10.1.100/32:any dst-address=10.10.1.200/32:any protocol=all action=encrypt level=require\
  ipsec-protocols=esp  tunnel=no \
  sa-src-address=10.10.1.100 sa-dst-address=10.10.1.100 proposal=VPN manual-sa=none dont-fragment=clear disabled=no 
  / ip ipsec peer \
  add address=10.10.1.200 secret="ipsec" generate-policy=no exchange-mode=main send-initial-contact=yes 
  proposal-check=obey   hash-algorithm=md5 \
  enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no\ 
  / ip ipsec proposal\ 
  add name="IPSec" auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no

Cisco Tunnel Interface:

  interface Tunnel1
  description **Cisco Peer**
  ip address 192.168.0.17 255.255.255.252
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip mtu 1480
  ip rip v2-broadcast
  ip tcp adjust-mss 1400
  load-interval 30
  tunnel source 10.10.1.200
  tunnel destination 10.10.1.100
  tunnel mode ipip
  tunnel protection ipsec profile encrypt
  hold-queue 1024 in
  hold-queue 1024 out