Now that is odd. I have three ipsec polices (X’es used to mask IPs):
[itpasja@MikroTik] /ip ipsec policy> print
Flags: T - template, X - disabled, D - dynamic, I - inactive, * - default
0 T * group=default src-address=::/0 dst-address=::/0 protocol=all proposal=default template=yes
1 ;;; ZWIK
src-address=10.12.12.0/24 src-port=any dst-address=10.0.0.0/24 dst-port=any protocol=all action=encrypt
level=require ipsec-protocols=esp tunnel=yes sa-src-address=XX.XX.XX.XX sa-dst-address=XX.XX.XX.XX
proposal=itpasja priority=0
2 ;;; NE
src-address=10.12.12.0/24 src-port=any dst-address=192.168.2.0/24 dst-port=any protocol=all action=encrypt
level=require ipsec-protocols=esp tunnel=yes sa-src-address=XX.XX.XX.XX sa-dst-address=XX.XX.XX.XX
proposal=itpasja priority=0
3 ;;; Pakon
src-address=10.12.12.0/24 src-port=any dst-address=192.168.1.0/24 dst-port=any protocol=all action=encrypt
level=require ipsec-protocols=esp tunnel=yes sa-src-address=XX.XX.XX.XX sa-dst-address=XX.XX.XX.XX
proposal=pakon priority=0
Since I do not have static IP here I use a simple script found on Greg Sowell’s webpage which checks my current WAN IP and sets police’s sa-src-address according to that value:
:local WANip [/ip address get [find interface="ether1"] address]
:log info "Interface IP is $WANip"
:local WANip [:pick "$WANip" 0 ([:len $WANip] - 3)]
:log info "IP sans the slash notation is $WANip"
/ip ipsec policy set 1 sa-src-address=$WANip
From what I’ve read the number after ‘set’ (in the last line of the script) points to a certain policy. The only problem is that it only works when ‘set 1’ is there, and the script changes sa-src-address to my WAN’s IP in the ZWIK commented policy. Putting there ‘set 2’ or ‘set 3’ does not work. The command itself is ok as when I type it in terminal window it works (eg. /ip ipsec policy set 2 sa-src-address=XX.XX.XX.XX sets NE commented policy’s sa-src-address to XX.XX.XX.XX) but it does not when in script.
What am I missing here?