in this scenario i connect more clients.
but i would assign an specific ip to single client.
for example now when connect
client1 chr assign 10.115.210.199
client2 chr assign 10.115.210.200
etc…
i would when client1 is connected use ip 10.115.210.200 or 10.115.210.221 , the important is always same ip…
is possible?
seems like when i create a secret for ovpn and assign a “remote address”.
Currently, you need that each /ip ipsec identity row points to its dedicated /ip ipsec mode-config row, and each /ip ipsec mode-config row points to its dedicated /ip pool row. No other way to link the client’s identity to an address.
but i try to create several mod config (with different pool or single address) and identity, but remote client have not static ip so sometimes client1 when connect takes client2 ip…
maybe in identity can i set match by certificate (now is remote id) ?
or i must create more peers , but the unique thing can i change is port. so every client use different port???
Either use match-by=certificate (which requires to have the initiators’ certificates at the responder), or change auto in my-id at initiator side and remote-id at responder side to e.g. fqdn:some.client.name.
i try to set:
on responder (server chr)
peer: ike2-office
auth method: digital signature
certificate: server1-ipsec
my id type: auto
remote id type: office.mydomain.tld
match by: remote id
mode config : ike2-office (where i set “static” local ip address)
generate policy: port strict
on initiator ( mikrotik at my office)
peer: ike2-chr
auth method: digital signature
certificate: office.mydomain.tld.p12_0
my id type: fqdn
my id: office.mydomain.tld
remote id type: auto
match by: remote id
mode config : request only
generate policy: port strict
but on chr in log i see
new ike2 SA (R): xxxxxxxxxxxxxxxxxx…
identity not found for peer: FQDN: office.mydomain.tld
To me the configuration seems fine. Do you have a single peer at the CHR, and the identity is linked to it? Better post the export of both configurations. Also, what RouterOS versions are you running?
first of all, I knew why I suggested to use text editor to substitute IP addresses in my automatic signature: you've changed the public IP in the /ip ipsec peer row of the export of the Mikrotik in the office, but you forgot you use it also in the peer name to which /ip ipsec identity refers, so it remained there unchanged. You may want to edit the post.
So the blue identity row with the correct remote-id is linked to the blue row of peer - which is, however, shadowed by the green one, as it has the same values of address and exchange-mode. So link the blue identity row to the green peer row and you should be good.
thank you for advice, next time i correct also domain name…
ok, i have deleted the row
add exchange-mode=ike2 name=ike2-office passive=yes profile=ike2 send-initial-contact=no
now i have only 1 peer
add exchange-mode=ike2 name=ike2 passive=yes profile=ike2 send-initial-contact=no
in identties now have
/ip ipsec identity
add auth-method=digital-signature certificate=server1-ipsec generate-policy=port-strict
mode-config=ike2-office peer=ike2 policy-template-group=ike2-policies remote-id=fqdn:office.ab-tech.it
add auth-method=digital-signature certificate=server1-ipsec disabled=yes generate-policy=port-strict
mode-config=ike2-mod-conf peer=ike2 policy-template-group=ike2-policies
but now i have this error
peer's ID does not match certificate
my client (office) must have ip associated to fqdn really?
that is dns record office.ab-tech.it don’t resolve to real ip at my office.
my office have a dinamic ip, so can i use ip cloud? or is only an “id” that match on both sites?
It should be enough to change the ID values to match the CN (Common Name) fields of the certificates. This authentication method works even if the peer is on a private IP behind a NAT, RouterOS doesn’t use a DNS query to check that the fqdn used as peer ID resolves to the IP from which the request came. Or use match-by=certificate, which means that you have to import the certificate of the responder to the initiator and vice versa.
thank you, now works!!!
i found problem, when i create certificate i dont’t select key usage (digital signature)
now i create new cert with that option with common name abc.deg.xyz and now works.
For use to authenticate IPsec clients, it should be sufficient that key-usage of the certificate is set to tls-client,tls-server (although ipsec-something values exist too.
sorry, for i ask again but it’s related. (if you prefer i can open a new thread)
i setup an ikev2 on my router in office (this time as a server)
but mikrotik is behind a NAT (isp router , that i can’t touch)
now i would connect with my laptop (also behind a NAT).
so if i connect with success 2 mikrotik (both behind nat) with fqdn id.
but in windows how i can specify fqdn?
i used this config https://wiki.mikrotik.com/wiki/File:Ike2v2_cert_win.png https://wiki.mikrotik.com/wiki/File:Ike2v2_conf_win.png
but wont work , and i suppose the problem is fqdn id…
The log shows that the Windows embedded VPN client sends the certificate as its initiator ID when using the machine certificate, and you to my knowledge you cannot change that:
23:08:18 ipsec processing payload: ID_I
23:08:18 ipsec ID_I (DER DN): CN=w10-450g6,C=xy,ST=,L=here,O=me,OU=mikrotik,SN=
So match-by=certificate (or match-by=remote-id remote-id=auto which is effectively the same in this case), is currently the only option for the Windows VPN client in IKEv2 mode; once Mikrotik starts supporting EAP with user certificates, this may change.
As RouterOS does not check whether the fqdn provided as initiator ID resolves to source address of the initiator request (as doing so would make it impossible to support road warrior initiators), match-by=certificate is as secure as match-by=remote-id remote-id=fqdn:some.domain would be.
ok, i understand . last question…
so if i have this situation :
my-laptop (192.168.1.3)
|
LAN 192.168.1.1
router isp @ home (NAT)
WAN IP DINAMIC
← - - - - - - INTERNET - - - - - - >
WAN STATIC IP
router isp @ office (NAT) with port forwarding on mikrotik 192.168.2.2
LAN ROUTER ISP 192.168.2.1
|
WAN MIKROTIK 192.168.2.2
mikrotik (NAT)
LAN 192.168.88.1
now i’m using openvpn without problem
but i’m studying ipsec, so
is there a possibility to make everything work with ipsec? ù
or is better remain with openvpn?
If I get you right, you ask about the scenario where the responder (“server”) Mikrotik cannot have a public IP directly on itself. If so, yes, this is possible, but you either have to touch the Windows registry to make the embedded VPN client tolerate the existence of NAT at the responder side, or you have to use a dirty trick as described here.
i try to connect with another pc and works perfectly!!!
i think the problem is on my laptop i have also a certificate of my CHR (that of my first post)
can i have only one ipsec ikev2 on a single pc/laptop?
or i was wrong on setup ikev2 server?