IKE Traffic
To avoid problems with IKE packets hit some SPD rule and require to encrypt it with not yet
established SA (that this packet perhaps is trying to establish), locally originated packets with UDP
source port 500 are not processed with SPD. The same way packets with UDP destination port 500
that are to be delivered locally are not processed in incoming policy check.
Setup Procedure
To get IPsec to work with automatic keying using IKE-ISAKMP you will have to configure policy,
peer and proposal (optional) entries.
For manual keying you will have to configure policy and manual-sa entries.
Policy Settings
Home menu level: /ip ipsec policy
Description
Policy table is needed to determine whether encryption should be applied to a packet.
Property Description
action ( accept | drop | encrypt ; default: accept ) - specifies what action to undertake with a packet
that matches the policy
• accept - pass the packet
• drop - drop the packet
• encrypt - apply transformations specified in this policy and it's SA
decrypted ( integer ) - how many incoming packets were decrypted by the policy
dont-fragment ( clear | inherit | set ; default: clear ) - The state of the don't fragment IP header
field
• clear - clear (unset) the fields, so that packets previously marked as don't fragment got
fragmented
• inherit - do not change the field
• set - set the field, so that each packet matching the rule will not be fragmented
dst-address ( IP address | netmask | port ; default: 0.0.0.0/32:any ) - destination IP address
encrypted ( integer ) - how many outgoing packets were encrypted by the policy
in-accepted ( integer ) - how many incoming packets were passed through by the policy without an
attempt to decrypt
in-dropped ( integer ) - how many incoming packets were dropped by the policy without an
attempt to decrypt
ipsec-protocols ( multiple choice: ah | esp ; default: esp ) - specifies what combination of
Authentication Header and Encapsulating Security Payload protocols you want to apply to matched
traffic. AH is applied after ESP, and in case of tunnel mode ESP will be applied in tunnel mode and
Page 306 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.
To Next Page
Loading...
General