IPsec with Google Cloud Platform using BGP on v7

CyberMuz · Thu Nov 09, 2023 7:37 pm

Hi all,
is it possible to establish the VPN (IPsec connection) between RouterOS v7 and Google Cloud Platform that is using the BGP for distributing routes?
I found one thread on this forum from 2018 but I'm not sure if that is the correct way and that this configuration would work on ROS7.

My main concern is that in that example two IPsec policy rules are added

/ip ipsec policy
add dst-address=169.254.0.2/32 level=unique peer=peer2 sa-dst-address=XX.XXX.XX.221 sa-src-address=0.0.0.0 src-address=169.254.0.1/32 tunnel=yes
add dst-address=10.XX.XX.0/29 level=unique peer=peer2 sa-dst-address=XX.XXX.XX.221 sa-src-address=0.0.0.0 src-address=0.0.0.0/0 tunnel=yes

The first policy rule is for the BGP peer, this is clear. But the purpose of the second policy is not rally clear to me. Do I need this policy if all received routes will have 169.254.0.2 as the next hop? I also don't like the " src-address=0.0.0.0/0" setting in this example, and setting the 10.XX.XX.0/29 as dst-address is not really 'dynamic', if BGP announces any new routes I would need to add them manually.

Can anyone provide me with the working example of Mikrotik IPsec and BGP configuration for GCP for ROS7?
I can't test it myself at this moment since I will only get the access to GVP next week but I would like to prepare as much as possible and having a working example would be of great help.
Thank you!

CyberMuz · Mon Feb 05, 2024 6:45 pm

Hi all, sorry for resurrecting this thread, but I would really appreciate any information about this topic. Has anyone managed to get IPsec connection working with Google Cloud and BGP distributed routes?

IPsec with Google Cloud Platform using BGP on v7

IPsec with Google Cloud Platform using BGP on v7

Re: IPsec with Google Cloud Platform using BGP on v7

Who is online