View source for MikroTik router to CISCO PIX Firewall IPSEC

=== Configuration of router running Mikrotik RouterOS  ===

This configuration is simple and very similar to official 3.0 [http://www.mikrotik.com/testdocs/ros/3.0/vpn/ipsec.php ipsec manual page]

'''Mikrotik Router'''

Add addresses on interfaces
 [admin@Mikrotik] > ip address add \
 	address=1.0.0.2/30 broadcast=1.0.0.3 disabled=no \
 	interface=public network=1.0.0.0
 [admin@Mikrotik] > ip address add \
 	address=172.22.1.1/24 broadcast=172.22.1.255 disabled=no \
 	interface=inside network=172.22.1.0


Add ip routes
 [admin@Mikrotik] > ip route add \
 	disabled=no distance=1 dst-address=0.0.0.0/0 gateway=1.0.0.1 \
 	scope=30 target-scope=10


Add accept and masquerading rules in SRC-NAT 
 [admin@Mikrotik] > ip firewall nat add \
 	chain=srcnat \
 	src-address=172.22.1.0/24 \
 	dst-address=172.22.2.0/24 action=accept
 
 [admin@Mikrotik] > ip firewall nat add \
 	chain=srcnat out-interface=public action=masquerade


Add peer (with phase1 configuration parameters), DES and SHA1 will be used to protect IKE traffic 
for MikroTik router

 [admin@MikroTik] > ip ipsec peer add \
 	address=2.0.0.2 secret="gvejimezyfopmekun" enc-algorithm=des


Set encryption proposal (phase2 proposal - settings that will be used to encrypt actual data) to use DES to encrypt data 
for MikroTik router
 [admin@MikroTik] > ip ipsec proposal set default enc-algorithms=des auth-algorithms=md5


Add policy rule that matches traffic between subnets and requires encryption with ESP in tunnel mode 
for MikroTik router
 [admin@MikroTik] > ip ipsec policy add \
 	src-address=172.22.1.0/24 \
 	dst-address=172.22.2.0/24 \
 	action=encrypt \
 	tunnel=yes sa-src=1.0.0.2 sa-dst=2.0.0.2


Add firewall rules to permit VPN traffic and private traffic
 [admin@Mikrotik] >ip firewall add \
 	action=accept chain=input disabled=no protocol=ipsec-esp src-address=2.0.0.2
 
 [admin@Mikrotik] >ip firewall add \
 	action=accept chain=customer disabled=no dst-address=172.22.1.0/24 \
  	in-interface=public out-interface=inside src-address=172.22.2.0/24