Establish a routed IPSec tunnel between an EdgeRouter an Mikrotik

RouterOS General
1

Hi Everyone,

I’ve been trying for some days now to get an IPSec routed tunnel to work between an EdgeRouter and Mikrotik. We currently only using EdgeRouters with this customer but we’re looking forward to replacing the first with a CHR instance, afterwards phasing out the EdgeRouters in preference for Mikrotiks with good IPSec performance.

The thing we noticed is that Mikrotik has no support for (what is default on the EdgeRouter platform) vti interfaces? So as we read we should be dealing with a tunnel (tun) interface on the ER side and an GRE tunnel on the MK side? We’ve been trying to use this guide but it’s outdated (commands don’t align), we’ve followed other guides as well but no luck.

The is our config on the EdgeRouter side:

# show interfaces tunnel tun16
 address 10.250.16.2/30
 encapsulation gre
 local-ip ed.ge.rtr.ip
 mtu 1476
 remote-ip mk.tik.rtr.ip
 
 # show vpn ipsec 
 auto-firewall-nat-exclude enable
 esp-group FOO16 {
     lifetime 3600
     pfs enable
     proposal 1 {
         encryption aes128
         hash sha1
     }
 }
 ike-group FOO16 {
     lifetime 28800
     proposal 1 {
         dh-group 14
         encryption aes128
         hash sha1
     }
 }
 site-to-site {
     peer mk.tik.rtr.ip {
         authentication {
             mode pre-shared-secret
             pre-shared-secret supersecredkey
         }
         default-esp-group FOO16
         description VPCO-mtik
         ike-group FOO16
         local-address ed.ge.rtr.ip
         tunnel 16 {
             protocol gre
         }
     }

Here’s the Mikrotik side (at the moment):

> /ip ipsec export 
# feb/15/2022 20:28:08 by RouterOS 6.48.6
# software id = 
#
#
#
/ip ipsec peer
add address=ed.ge.rtr.ip/32 local-address=mk.tik.rtr.ip name=gre16
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-128
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc,aes-128-ctr,aes-128-gcm pfs-group=modp2048
add enc-algorithms=aes-128-cbc,aes-128-ctr,aes-128-gcm name=proposal1 pfs-group=modp2048
/ip ipsec identity
add peer=gre16 secret=supersecredkey
/ip ipsec policy
add dst-address=ed.ge.rtr.ip/32 peer=gre16 protocol=ipsec-esp src-address=mk.tik.rtr.ip/32 tunnel=yes
 > interface gre export 
# feb/15/2022 20:28:24 by RouterOS 6.48.6
# software id = 
#
#
#
/interface gre
add allow-fast-path=no ipsec-secret=supersecredkey local-address=mk.tik.rtr.ip mtu=1476 name=gre16 remote-address=ed.ge.rtr.ip
 > ip address 
add  comment  disable  edit  enable  export  find  print  remove  set
 > ip address export 
# feb/15/2022 20:28:53 by RouterOS 6.48.6
# software id = 
#
#
#
/ip address
***xxx***
add address=10.250.16.1/30 interface=gre16 network=10.250.16.0

Very grateful for any advice/help!

2

Hi

I have written two blog posts exactly about this topic and I believe you should find there what you’re looking for.

https://sleepytechbloke.wordpress.com/2022/01/30/mikrotik-ipsec-vpn-vendor-interoperability/
https://sleepytechbloke.wordpress.com/2022/01/31/ipsec-site-to-site-vpn-between-fortigate-and-mikrotik-with-routing/

The latter is for MikroTik ↔ FortiGate but since FortiGates kind of default to VTI as well, this should still apply to you, as far as the MikroTik part of the post.

TLDR, you don’t need GRE on the MikroTik’s side, just tunnel VPN and create corresponding IPSEC policies. But that’s everything explained thoroughly in the second blog post.

3

Hi @azzurro,

Thank you for your contribution. For our purpose, since we’ll be using ospf, we will need a tunneled interface with IP’s on each side of the tunnel for the routers to communicate. What would be the correct configuration for such a set up?

4

Hi

in that case you’ll have to go with GRE over tunnel mode IPSEC or IPIP over tunnel mode IPSEC, if your EdgeRouter supports that.

edit: GRE or IPIP will have to be configured on both sides, so you’ll have to configure a tunnel mode IPSEC VPN tunnel on your EdgeRouter as well.

5

Which is what I have been trying to do. A GRE tunnel worked fine (unencrypted), but the IPSec fails. If you’d be so kind to take a look at the configuration as described in my OP and possibly see what I’m missing.

6

I managed to get this to work:
Miktorik RouterOS:

[admin@RouterOS] > export 

/interface gre
add allow-fast-path=no ipsec-secret=passwordpassword name=gre-sict remote-address=ed.ge.rtr.ip
/interface list
add name=WAN
add name=LAN


/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-128
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc,aes-128-ctr,aes-128-gcm pfs-group=modp2048

/ip address
add address=10.250.16.1/30 interface=gre-sict network=10.250.16.0

/ip ipsec policy
add dst-address=ed.ge.rtr.ip/32 peer=gre-sict protocol=gre src-address=mk.tik.rtr.ip/32 tunnel=yes

EDGEROUTER:

EDGEROUTER# show interfaces tunnel tun16
 address 10.250.16.2/30
 encapsulation gre
 local-ip ed.ge.rtr.ip
 remote-ip mk.tik.rtr.ip
[edit]
EDGEROUTER# show vpn ipsec site-to-site peer mk.tik.rtr.ip 
 authentication {
     mode pre-shared-secret
     pre-shared-secret passwordpassword
 }
 default-esp-group FOO16
 description VPCO-GRE
 ike-group F0016
 local-address ed.ge.rtr.ip
 tunnel 16 {
     protocol gre
 }
[edit]