August 31, 2016

Mikrotik Router Site to Site IPSec VPN Tunnel Configuration has One side DHCP Address

HQ Router Configuration:
[admin@HQ] > ip dhcp-client add interface=ether1  use-peer-dns=yes add-default-route=yes disabled=no
[admin@HQ] > ip address  add address= 192.168.2.1/24 interface=ether2
[admin@HQ] > ip firewall nat  add  chain=srcnat action=accept src-address=192.168.2.0/24 dst-address=192.168.1.0/24

[admin@HQ] > ip firewall nat Add chain=srcnat action=masquerade out-interface=ether1

 [admin@HQ] > ip ipsec peer add address=180.140.100.2/32:500 auth-method=pre-shared-key secret="password" generate-policy=no exchange-mode=main
     send-initial-contact=yes nat-traversal=yes proposal-check=obey hash-algorithm=sha1 enc-algorithm=3des
     dh-group=modp1024 lifetime=1d lifebytes=0 dpd-interval=disable-dpd dpd-maximum-failures=1

[admin@HQ] > ip ipsec proposal add name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m pfs-group=modp1024
[admin@HQ] > ip ipsec  policy add  src-address=0.0.0.0/0:any dst-address=0.0.0.0/0:any protocol=all action=encrypt level=require ipsec-protocols=esp
     tunnel=yes sa-src-address=0.0.0.0 sa-dst-address=180.140.100.2 proposal=default priority=0
Branch router configuration:
[admin@Remote] > ip address  add address= 80.140.100.2/30 interface=ether1

[admin@Remote] > ip  address  add address= 192.168.1.1/24 interface=ether2
[admin@Remote] > ip firewall nat  add  chain=srcnat action=accept src-address=192.168.1.0/24 dst-address=192.168.2.0/24

[admin@Remote] > ip firewall nat Add chain=srcnat action=masquerade out-interface=ether1

[admin@Remote] > i p route add dst-address=0.0.0.0 gateway=180.140.100.1

[admin@Remote] > ip ipsec proposal add name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m pfs-group=modp1024
[admin@Remote] > ip ipsec peer add address=0.0.0.0/0 port=500 auth-method=pre-shared-key secret="password"
     generate-policy=yes exchange-mode=main send-initial-contact=yes
     nat-traversal=no my-id-user-fqdn="" proposal-check=obey
     hash-algorithm=sha1 enc-algorithm=3des dh-group=modp1024 lifetime=1d
     lifebytes=0 dpd-interval=2m dpd-maximum-failures=5

No comments:

Post a Comment