routeros-ipsec
Installation
SKILL.md
RouterOS IPsec
IPsec on RouterOS is configured with a chain of menus under /ip/ipsec. Know which one holds what before you change anything:
| Menu | Role |
|---|---|
profile |
Phase 1 (IKE) parameters: hash, encryption, DH group, lifetime, NAT-T, DPD |
peer |
The remote end: address, exchange-mode (main, aggressive, ike2), profile, passive, send-initial-contact |
identity |
How the peer is authenticated: auth-method (pre-shared-key, digital-signature, eap, rsa-key ...), secrets, certificates |
proposal |
Phase 2 (ESP/AH) parameters: algorithms, PFS group, lifetime |
policy (and policy/group) |
Which traffic is encrypted (src-address, dst-address, tunnel=yes, action=encrypt), or a template for dynamic peers |
mode-config |
Addresses, DNS and so on pushed to road warrior clients |
active-peers, installed-sa, statistics |
Read-only state |
Both ends must agree on every phase 1 and phase 2 setting. Time must be right on both ends (IPsec breaks when clocks drift:
see NTP in routeros-system-utilities).