Does the above mean that the mobile clients will get addresses from that range (192.168.8.0 - 192.168.9.255)?
Regardless that, the IPsec configuration will look as follows:
/ip ipsec profile add name=polkomtel-profile enc-algorithm=3des dh-group=modp1024
/ip ipsec peer add name=polkomtel-peer address=212.2.102.235 exchange-mode=main profile=polkomtel-profile local-address=eee.fff.ggg.hhh
/ip ipsec identity add peer=polkomtel auth-method=pre-shared-key secret=KLUCZ_PreSharedKey
/ip ipsec proposal add name=polkomtel-proposal auth-algorithms=sha1 enc-algorithms=3des pfs-group=modp1024
/ip ipsec policy add peer=polkomtel-peer proposal=polkomtel-proposal src-address=eee.fff.ggg.hhh dst-address=212.2.100.177 protocol=gre tunnel=yes level=unique
Since eee.fff.ggg.hhh is supposingly your public WAN IP which is up directly on your Mikrotik, there is no need to take special measures for NAT. If this is not the case, say so.
The GRE interface will look as follows:
/interface gre add name=gre-polkomtel local-address=eee.fff.ggg.hhh remote-address=212.2.100.177
The following line is actually not necessary unless you’d want to use recursive next-hop search which requires that the gateway items of all routes involved are given as IP addresses:
/ip address add address=aaa.bbb.ccc.ddd/30 interface=gre-polkomtel
iii.jjj.kkk.lll/24 in the following should probably be substituted by 192.168.8.0/23 if I’ve understood properly the part I’ve quited above:
/ip route add dst-address=iii.jjj.kkk.lll/24 gateway=gre-polkomtel
The ip route 212.2.100.177 255.255.255.255 Tunnel0 part of the Cisco configuration makes little sense to me, except if they want to make sure that some route towards 212.2.100.177 is defined and thus the packet will be routed somewhere regardless the rest of your routing, so that the crypto-map could match on it and divert it to the IPsec tunnel. Any other route whose dst-address includes 212.2.100.177, including the default one, is sufficient for such purpose.
A separate headache is that GRE is handled very specifically by Mikrotik’s firewall and that the GRE keepalive mechanism is also specific. See this post regarding the keepalive, and bear in mind that unexpected GRE packets are labeled as connection-state=invalid by current RouterOS versions, so you have to make sure that a rule dropping invalid packets in chain input of /ip firewall filter doesn’t drop GRE packets. If you are not familiar with Mikrotik firewall, better post the export of your current one.