match each other, id est src-address=1.2.3.0/27 on one router and dst-address=1.2.3.0/28 on
another would not work. Source address values on one router MUST be equal to destination address
values on the other one, and vice versa.
Example
To add a policy to encrypt all the traffic between two hosts (10.0.0.147 and 10.0.0.148), we need do
the following:
[admin@WiFi] ip ipsec policy> add sa-src-address=10.0.0.147 \
\... sa-dst-address=10.0.0.148 action=encrypt
[admin@WiFi] ip ipsec policy> print
Flags: X - disabled, D - dynamic, I - invalid
0 src-address=10.0.0.147/32:any dst-address=10.0.0.148/32:any protocol=all
action=encrypt level=require ipsec-protocols=esp tunnel=no
sa-src-address=10.0.0.147 sa-dst-address=10.0.0.148 proposal=default
manual-sa=none dont-fragment=clear
[admin@WiFi] ip ipsec policy>
to view the policy statistics, do the following:
[admin@WiFi] ip ipsec policy> print stats
Flags: X - disabled, D - dynamic, I - invalid
0 src-address=10.0.0.147/32:any dst-address=10.0.0.148/32:any
protocol=all ph2-state=no-phase2 in-accepted=0 in-dropped=0
out-accepted=0 out-dropped=0 encrypted=0 not-encrypted=0 decrypted=0
not-decrypted=0
[admin@WiFi] ip ipsec policy>
Peers
Home menu level: /ip ipsec peer
Description
Peer configuration settings are used to establish connections between IKE daemons (phase 1
configuration). This connection then will be used to negotiate keys and algorithms for SAs.
Property Description
address ( IP address | netmask | port ; default: 0.0.0.0/32:500 ) - address prefix. If remote peer's
address matches this prefix, then this peer configuration is used while authenticating and
establishing phase 1. If several peer's addresses matches several configuration entries, the most
specific one (i.e. the one with largest netmask) will be used
dh-group ( multiple choice: modp768 | modp1024 | modp1536 ; default: esp ) - Diffie-Hellman
MODP group (cipher strength)
enc-algorithm ( multiple choice: des | 3des | aes-128 | aes-192 | aes-256 ; default: 3des ) -
encryption algorithm. Algorithms are named in strength increasing order
exchange-mode ( multiple choice: main | aggressive | base ; default: main ) - different ISAKMP
phase 1 exchange modes according to RFC 2408.DO not use other modes then main unless you
know what you are doing
generate-policy ( yes | no ; default: no ) - allow this peer to establish SA for non-existing policies.
Page 308 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.
To Next Page
Loading...
General