Chapter 5 of 7 · MikroTik MTCUME

IPsec

IKE phases mapped to RouterOS peer, profile, identity, proposal and policy objects, plus installed SAs and NAT.

  • 4topics
  • 19 minfast track
  • 3diagrams and exhibits
Start with IPsec Introduction

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1IPsec IntroductionUnderstand IPsec on RouterOS: AH and ESP, tunnel and transport mode, the two IKE phases, and how profile, peer, identity…Diagram5 min
  2. 2IPsec Peer, Profile and IdentityConfigure the IPsec phase 1 objects on RouterOS: peer address, exchange mode, profile algorithms, identity and pre shared key…4 min
  3. 3IPsec Policy and ProposalConfigure IPsec phase 2 on RouterOS: write a policy that selects traffic and sets tunnel mode, build a proposal, mirror both ends…Diagram5 min
  4. 4Installed SAs and IPsec with NATRead the IPsec installed SA table on RouterOS for counters and keys, and handle NAT with an accept rule, NAT traversal and the…Diagram5 min

About this chapter

What this chapter covers

IPsec protects IP traffic with encryption and authentication, and this chapter shows how RouterOS builds it.

You will learn the ideas behind IPsec, and then each configuration object in turn. The chapter closes with the live security associations, and with the way NAT interferes with a tunnel and how to prevent it.

It also connects back to earlier chapters, because L2TP uses IPsec for its encryption.

How the topics fit together

The objects follow the two phases of IKE, so learning the phases tells you where each object belongs.

IntroductionESP, modes, IKE phasesphase 1Peerprofile and identityphase 2Policy and proposaltraffic and algorithmsresultInstalled SA and NATlive keys, firewall

The pages follow that order:

  • Introduction explains ESP, AH, tunnel mode, the two phases and the list of RouterOS objects.
  • Peer covers phase 1, with the profile and the identity that holds the key.
  • Policy and proposal cover phase 2, which traffic is protected and how.
  • Installed SA and NAT show how to read the live associations and how to keep NAT from breaking the tunnel.

When a tunnel fails, the phases give you a method. If phase 1 fails, check the peer, profile and key. If phase 1 works and phase 2 fails, check the proposal and the policy.

Note

Many IPsec faults come from two ends that disagree on a single setting. Compare both routers side by side before you change anything.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with diagrams and example commands.
  • What to remember for the exam: the facts to memorise.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Build a site to site tunnel between two lab routers while you read. Send a ping between the two LANs to trigger phase 2, and then read the installed SA table to see the counters rise.

Read the log with the ipsec topic whenever something fails. It names the step that stopped, which saves a lot of guessing.

Ready for more practice?

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.