IPsec · Topic 3 of 4

IPsec Policy and Proposal

Configure IPsec phase 2 on RouterOS: write a policy that selects traffic and sets tunnel mode, build a proposal, mirror both ends and read policy state.

5 min
Includes a diagram

In a nutshell

A policy matches traffic with src-address and dst-address.
tunnel=yes selects tunnel mode, which site to site links need.
The action is encrypt, none or discard.

What it is

A policy chooses which traffic IPsec protects, and a proposal sets the algorithms that protect it.

These are the phase 2 objects. The policy is the rule, and the proposal is the set of cryptographic choices that the policy uses.

Together they decide what is encrypted, between which addresses, and how.

How it works

The policy matches packets, hands them to IPsec, and takes its algorithms from the proposal.

The proposal

/ip ipsec proposal add name=prop1 auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=modp2048 lifetime=30m

Setting	What it does
`auth-algorithms`	Algorithms that authenticate the packets, such as sha1 or sha256.
`enc-algorithms`	Algorithms that encrypt the packets, such as aes-128-cbc or aes-256-cbc.
`pfs-group`	Group for perfect forward secrecy, or none to disable it.
`lifetime`	How long phase 2 keys last before they are renewed.

A proposal named default exists. A proposal can list more than one algorithm, and the two routers pick one that both support. The lists must overlap.

The policy

/ip ipsec policy add src-address=192.168.1.0/24 dst-address=192.168.2.0/24 sa-src-address=203.0.113.1 sa-dst-address=203.0.113.2 tunnel=yes action=encrypt proposal=prop1 peer=peer1

Setting	What it does
`src-address` and `dst-address`	The traffic the policy matches.
`src-port`, `dst-port` and `protocol`	Optional narrowing of the match.
`sa-src-address` and `sa-dst-address`	The two router addresses that carry the tunnel.
`tunnel`	Yes for tunnel mode, no for transport mode.
`action`	Encrypt, none or discard.
`level`	How strictly IPsec is required.
`ipsec-protocols`	ESP or AH.
`proposal`	The proposal to use.
`peer`	The peer for this policy.

Generated policies

A router that waits for many remote peers, such as a road-warrior server, cannot hold a fixed policy for every client. The peer setting generate-policy lets it build a policy when a remote peer asks for one. It is usually used together with passive=yes.

Value	Effect
`no`	No policy is generated. Only the policies you wrote are used.
`port-override`	A policy is generated, and the port can be taken from the remote request.
`port-strict`	A policy is generated, and the port is handled strictly.

/ip ipsec peer set peer1 generate-policy=port-override
/ip ipsec policy print

Generated policies are dynamic, so they carry the flag D in the policy list and disappear when the association ends. In RouterOS v7 the same setting is on the identity (/ip ipsec identity), not on the peer.

The three actions

Action	Effect
`encrypt`	Matching traffic is protected by IPsec.
`none`	Matching traffic passes without IPsec.
`discard`	Matching traffic is dropped.

The action none is useful as an exception. A policy with none placed above a broader policy keeps some traffic out of the tunnel.

Mirrored policies

Router A and Router B each hold an IPsec policy for the tunnel between LAN A and LAN B. The two policies are mirror images, with source and destination addresses and the two router addresses swapped. The second router needs the mirror image.

/ip ipsec policy add src-address=192.168.2.0/24 dst-address=192.168.1.0/24 sa-src-address=203.0.113.2 sa-dst-address=203.0.113.1 tunnel=yes action=encrypt proposal=prop1 peer=peer2

Source and destination are swapped on both the traffic selectors and the router addresses. If the policies do not mirror, phase 2 does not match and no association forms.

Policy order

Policies are checked from the top of the list. The first match applies. Put narrow rules, such as exceptions, above wide ones.

Triggering and reading state

A new policy does not build keys until matching traffic appears. Send a ping between the two LANs to trigger it.

/ip ipsec policy print

The flags in the print show whether the policy is active. For a working policy, the phase 2 state reads established. A policy that stays in another state has not completed phase 2.

Where the traffic leaves

A masquerade rule changes the source address of outgoing packets before the policy is checked, so the packets no longer match. The next page covers the fix.

Perfect forward secrecy

If pfs-group is set in the proposal, both ends must set the same group. A mismatch fails phase 2 even when phase 1 worked.

What to remember for the exam

Seven facts cover most policy and proposal questions.

A policy matches traffic with src-address and dst-address.
tunnel=yes selects tunnel mode, which site to site links need.
The action is encrypt, none or discard.
sa-src-address and sa-dst-address are the two router addresses.
The proposal sets the phase 2 algorithms, lifetime and PFS group.
The two policies must mirror each other.
Matching traffic triggers phase 2 when no association exists.

Exam tip

A phase 1 that works with a phase 2 that never starts usually means the policies do not mirror, or the proposals do not overlap.

Common mistakes

These four errors appear again and again.

Policies that are not mirror images. Source and destination must be swapped on the other router.

Proposals with no common algorithm. The two lists must overlap, or phase 2 fails.

Forgetting tunnel=yes. The policy then works in transport mode, which is wrong for a LAN to LAN link.

Testing without traffic. Nothing is built until traffic matches the policy, so send a ping first.

Watch out

A policy with action=discard silently drops matching traffic. Check the action when a link carries nothing.

Check yourself

Work through these three questions.

Which policy settings identify the traffic to protect and the two tunnel endpoints?
src-address and dst-address identify the traffic. sa-src-address and sa-dst-address are the two router addresses.
What must be true of the policies on the two routers?
They must mirror each other, so source and destination are swapped on the other router.
What does the none action do?
Matching traffic passes without IPsec, so it works as an exception above a broader policy.

Topic 3 of 4 in IPsec

Test yourself on IPsec

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.