IPsec transport not working

RouterOS General
1

Hey together,
I have issues regarding my Testlab. Two networks should be connected through an IPsec-Transport-Tunnel between the two “VPN”-routers as shown in the attachment.
I want to encrypt traffic that is sent between the two vpn-routers. So I tried to configure the IPsec in transport-mode.

On the vpn-routers i configured the following:
Config VPN1

/ip ipsec peer
add address=10.10.10.2/32 local-address=10.10.10.1 name=vpn2
/ip ipsec profile
set [ find default=yes ] dh-group=modp2048 enc-algorithm=aes-256 \
    hash-algorithm=sha256
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=aes-256-cbc \
    pfs-group=modp2048
/ip address
add address=10.10.11.1/24 interface=ether1 network=10.10.11.0
add address=10.10.10.1/24 interface=ether2 network=10.10.10.0
/ip ipsec identity
add peer=vpn2 secret=test1234
/ip ipsec policy
set 0 disabled=yes
add dst-address=10.10.10.2/32 peer=vpn2 src-address=10.10.10.1/32
/ip route
add distance=1 dst-address=192.168.1.0/24 gateway=10.10.11.2
add distance=1 dst-address=192.168.2.0/24 gateway=10.10.10.2

Config VPN2

/ip ipsec peer
add address=10.10.10.1/32 local-address=10.10.10.2 name=vpn1
/ip ipsec profile
set [ find default=yes ] dh-group=modp2048 enc-algorithm=aes-256 \
    hash-algorithm=sha256
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=aes-256-cbc \
    pfs-group=modp2048
/ip address
add address=10.10.12.1/24 interface=ether1 network=10.10.12.0
add address=10.10.10.2/24 interface=ether2 network=10.10.10.0
/ip ipsec identity
add peer=vpn1 secret=test1234
/ip ipsec policy
set 0 disabled=yes
add dst-address=10.10.10.1/32 level=unique peer=vpn1 src-address=\
    10.10.10.2/32
/ip route
add distance=1 dst-address=192.168.1.0/24 gateway=10.10.10.1
add distance=1 dst-address=192.168.2.0/24 gateway=10.10.12.2

If I ping from the internal address of FW 1 (192.168.1.1) to FW2 the traffic is not encrypted when packet sniffer is activated.
This setup is part of a bigger infrastructure, so the setup should be exact like the testsetup below.

Thanks for help
IPsec_Transportmode_test.JPG

2

That’s correct. Your policy covers only traffic between 10.10.10.1 and 10.10.10.2, nothing else. If you want to encrypt also 192.168.1.1 and others, you need tunnel mode and policy that includes it.

Either that, or add some tunnel (ipip, gre) between the routers, use ipsec to encrypt only the tunnel itself, and route anything you want inside it.

3

Hi,
thanks for the quick reply. Maybe there is another possibility:
In the complete infrastructure the net 10.10.10.0/24 is a transfer-network. with 2 routers per site to prevent failover. the private-network-routes are announced through bgp via the transfer-net.

Is there another possibility to encrypt the traffic going through the transfer-network?

The encryption-configuration should be as dynamic as possible.
If not, I would set IPsec-Policies between all routers with the private networks in policy by tunnel mode, correct?

4

It could be the other way I mentioned, use some tunnel like IPIP or GRE between routers and everything in it can be as dynamic as you want, because it’s just like any other regular interface. IPSec can be used to encrypt the tunnel as whole (IPIP or GRE packets).

If there’s more routers in transfer network and everything needs to by dynamically connected with everything else, then I’m not sure, it’s probably too big and too dynamic for me.

5

Hey Sob,
thanks for the quick replies, I think now I got a practicable solution.
As you mentioned I configured EoIP-Tunnels between any router in the transfer-network, configured /30 networks on the EoIP-tunnels and changed my bgp-peers to use not the ip-address of the 10.10.10.0/24 transfer network, but take the addresses of the EoIP-endpoints.
The IPsec-policy is created automaticly and the failover works fine (only 3 pings lost).

by the way: I had to set the keepalive of the EoIPs down, because as long as the eoip is up, bgp doesn´t change the routes in case of failover.

Case closed, and have a nice weekend.

6

The solution is good, but you should have used IPIP or GRE instead of EoIP. Then proceed the same way (assign /30 nets, use as BGP peer address)
With that, you can make the same solution as you had, except it will be more efficient.