Site to Site IpSec Tunnel
Consider setup as illustrated below
Two remote office routers are connected to internet and office workstations behind routers are NATed. Each office has its own local subnet, 10.1.202.0/24 for Office1 and 10.1.101.0/24 for Office2. Both remote offices needs secure tunnel to local networks behind routers.
IP Connectivity
On both routers ether1 is used as wan port and ether2 is used to connect workstations. Also NAT rules are set tu masquerade local networks.
Office1 router:
/ip address
add address=192.168.90.1/24 interface=ether1
add address=10.1.202.1/24 interface=ether2
/ip route
add gateway=192.168.90.254
/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade
Office2 router:
/ip address
add address=192.168.80.1/24 interface=ether1
add address=10.1.101.1/24 interface=ether2
/ip route
add gateway=192.168.80.254
/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade
IpSec Peer's config
Next step is to add peer's configuration. We need to specify peers address and port and pre-shared-key. Other parameters are left to default values.
Office1 router:
/ip ipsec peer
add address=192.168.80.1/32:500 auth-method=pre-shared-key secret="test"
Office2 router:
/ip ipsec peer
add address=192.168.90.1/32:500 auth-method=pre-shared-key secret="test"
Policy and proposal
It is important that proposed authentication and encryption algorithms match on both routers. In this example we can use predefined "default" proposal
[admin@MikroTik] /ip ipsec proposal> print
Flags: X - disabled
0 name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m
pfs-group=modp1024
As we already have proposal as a next step we need correct IpSec policy. We want to encrypt traffic coming form 10.1.202.0/24 to 10.1.101.0/24 and vice versa.
Office1 router:
/ip ipsec policy
add src-address=10.1.202.0/24:any dst-address=10.1.101.0/24:any \
sa-src-address=192.168.90.1 sa-dst-address=192.168.80.1 \
tunnel=yes action=encrypt proposal=default
Office2 router:
/ip ipsec policy
add src-address=10.1.101.0/24:any dst-address=10.1.202.0/24:any \
sa-src-address=192.168.80.1 sa-dst-address=192.168.90.1 \
tunnel=yes action=encrypt proposal=default
Note that we configured tunnel mode instead of transport, as this is site to site encryption.
NAT Bypass
At this point if you will try to establish IpSec tunnel it will not work, packets will be rejected. This is because both routers have NAT rules that is changing source address after packet is encrypted. Remote router reiceves encrypted packet but is unable to decrypt it because source address do not match address specified in policy configuration.
To fix this we need to set up NAT bypass rule.
Office1 router:
/ip firewall nat
add chain=srcnat action=accept place-before=0 \
src-address=10.1.202.0/24 dst-address=10.1.101.0/24
Office2 router:
/ip firewall nat
add chain=srcnat action=accept place-before=0 \
src-address=10.1.101.0/24 dst-address=10.1.202.0/24
It is very important that bypass rule is placed at the top of all other NAT rules.
Consider setup as illustrated below
Two remote office routers are connected to internet and office workstations behind routers are NATed. Each office has its own local subnet, 10.1.202.0/24 for Office1 and 10.1.101.0/24 for Office2. Both remote offices needs secure tunnel to local networks behind routers.
IP Connectivity
On both routers ether1 is used as wan port and ether2 is used to connect workstations. Also NAT rules are set tu masquerade local networks.
Office1 router:
/ip address
add address=192.168.90.1/24 interface=ether1
add address=10.1.202.1/24 interface=ether2
/ip route
add gateway=192.168.90.254
/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade
Office2 router:
/ip address
add address=192.168.80.1/24 interface=ether1
add address=10.1.101.1/24 interface=ether2
/ip route
add gateway=192.168.80.254
/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade
IpSec Peer's config
Next step is to add peer's configuration. We need to specify peers address and port and pre-shared-key. Other parameters are left to default values.
Office1 router:
/ip ipsec peer
add address=192.168.80.1/32:500 auth-method=pre-shared-key secret="test"
Office2 router:
/ip ipsec peer
add address=192.168.90.1/32:500 auth-method=pre-shared-key secret="test"
Policy and proposal
It is important that proposed authentication and encryption algorithms match on both routers. In this example we can use predefined "default" proposal
[admin@MikroTik] /ip ipsec proposal> print
Flags: X - disabled
0 name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m
pfs-group=modp1024
As we already have proposal as a next step we need correct IpSec policy. We want to encrypt traffic coming form 10.1.202.0/24 to 10.1.101.0/24 and vice versa.
Office1 router:
/ip ipsec policy
add src-address=10.1.202.0/24:any dst-address=10.1.101.0/24:any \
sa-src-address=192.168.90.1 sa-dst-address=192.168.80.1 \
tunnel=yes action=encrypt proposal=default
Office2 router:
/ip ipsec policy
add src-address=10.1.101.0/24:any dst-address=10.1.202.0/24:any \
sa-src-address=192.168.80.1 sa-dst-address=192.168.90.1 \
tunnel=yes action=encrypt proposal=default
Note that we configured tunnel mode instead of transport, as this is site to site encryption.
NAT Bypass
At this point if you will try to establish IpSec tunnel it will not work, packets will be rejected. This is because both routers have NAT rules that is changing source address after packet is encrypted. Remote router reiceves encrypted packet but is unable to decrypt it because source address do not match address specified in policy configuration.
To fix this we need to set up NAT bypass rule.
Office1 router:
/ip firewall nat
add chain=srcnat action=accept place-before=0 \
src-address=10.1.202.0/24 dst-address=10.1.101.0/24
Office2 router:
/ip firewall nat
add chain=srcnat action=accept place-before=0 \
src-address=10.1.101.0/24 dst-address=10.1.202.0/24
It is very important that bypass rule is placed at the top of all other NAT rules.
No comments:
Post a Comment