IPsec · Topic 2 of 4

IPsec Peer, Profile and Identity

Configure the IPsec phase 1 objects on RouterOS: peer address, exchange mode, profile algorithms, identity and pre shared key, then check the active peer.

4 min

In a nutshell

The peer names the remote router with address and sets the IKE mode.
The profile holds the phase 1 hash, encryption, DH group and lifetime.
The identity holds the authentication method and the key.

What it is

An IPsec peer describes the remote router, and together with a profile and an identity it controls phase 1.

Phase 1 is where the two routers prove who they are and agree how to protect their own negotiation. The peer says whom to talk to, the profile says which algorithms to use, and the identity says how to authenticate.

If phase 1 does not complete, nothing else works.

How it works

You define the peer, attach a profile, and add an identity that holds the secret.

The peer

/ip ipsec peer add name=peer1 address=203.0.113.2/32 local-address=203.0.113.1 profile=p1 exchange-mode=main

Setting	What it does
`address`	Address of the remote router, with a prefix length.
`local-address`	Address this router uses as its source.
`profile`	The phase 1 profile to use.
`exchange-mode`	The IKE mode: main, aggressive or ike2.
`passive`	If yes, the router only answers and never starts negotiation.
`send-initial-contact`	Sends a message that tells the peer to drop old state.

Exchange mode

Main mode and aggressive mode belong to IKE version 1. Main mode protects the identity and takes more messages. Aggressive mode is shorter and exposes more.

The mode ike2 selects IKE version 2. Both ends must use the same IKE version, so a peer set to main mode does not negotiate with one set to ike2.

Passive peers

A router that sits at a head office and waits for many branches is set to passive=yes. It answers incoming negotiations but does not start them. The branches, which have fixed targets, start the negotiation.

The profile

The profile holds the phase 1 algorithms.

/ip ipsec profile add name=p1 hash-algorithm=sha256 enc-algorithm=aes-256 dh-group=modp2048 lifetime=1d nat-traversal=yes

Setting	What it does
`hash-algorithm`	Hash used to protect phase 1, such as sha1 or sha256.
`enc-algorithm`	Encryption for phase 1, such as aes-128 or aes-256.
`dh-group`	Diffie Hellman group used for the key exchange.
`lifetime`	How long the phase 1 association lasts before it is renewed.
`nat-traversal`	Allows IKE to detect and work through NAT.
`dpd-interval`	How often dead peer detection checks the peer.

A profile called default exists. Using your own profile makes the algorithms explicit and easy to match on both ends.

The identity

The identity authenticates the peer.

/ip ipsec identity add peer=peer1 auth-method=pre-shared-key secret=SharedKey1

Setting	What it does
`peer`	The peer this identity belongs to.
`auth-method`	Pre shared key, or a certificate based method such as rsa signature.
`secret`	The pre shared key, when that method is used.
`my-id` and `remote-id`	The names the routers present and expect.

A pre shared key is simple, and the key must be identical on both ends. A certificate method scales better, but it needs a certificate on each router.

Matching rules

For phase 1 to complete, the two ends must agree on four things:

the hash and encryption algorithms
the DH group
the IKE version or mode
the authentication method and key

Checking phase 1

/ip ipsec active-peers print
/ip ipsec peer print
/log print where topics~"ipsec"

A peer that has completed phase 1 appears in active-peers with its state. The log shows each step, and the last message before a stop usually names the problem, such as a mismatch or no proposal chosen.

Version note

The profile and identity objects exist from v6.43 and in v7. On older versions, the same phase 1 settings sit inside the peer, and the layout differs.

What to remember for the exam

Seven facts cover most peer questions.

The peer names the remote router with address and sets the IKE mode.
The profile holds the phase 1 hash, encryption, DH group and lifetime.
The identity holds the authentication method and the key.
exchange-mode chooses main, aggressive or ike2.
A passive peer only answers and never starts negotiation.
Both ends must agree on algorithms, DH group, IKE version and key.
/ip ipsec active-peers print shows completed phase 1 peers.

Exam tip

When phase 1 fails, compare the two profiles field by field before touching anything else.

Common mistakes

These four errors appear again and again.

Mismatched DH group or algorithms. The two profiles must offer something in common.

Different IKE versions. A main mode peer cannot negotiate with an ike2 peer.

A typed key that differs. One wrong character in the secret stops phase 1.

Both routers passive. Neither starts negotiation, so nothing happens.

Watch out

Aggressive mode exposes more information in the exchange. Prefer main mode or IKE version 2 where both ends support them.

Check yourself

Work through these three questions.

Which object holds the phase 1 algorithms, and which holds the key?
The profile holds the algorithms, DH group and lifetime. The identity holds the authentication method and the key.
What does passive=yes do on a peer?
The router only answers incoming negotiations and never starts one.
Which command lists peers that have completed phase 1?
/ip ipsec active-peers print.

Topic 2 of 4 in IPsec

Test yourself on IPsec

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.