and the router routes between them. The Subnet used for connecting router 1 and 2 is
10.4.254.0/24
Behind router2 are following subnets
10.1.0.0/16
10.2.0.0/16
10.3.0.0/16
10.4.0.0/16
0.0.0.0/0 for the Internet
And for security reasons it is necessary to encrypt the traffic between the routers. Basically the default route on the router1 should go trough the ipsec tunnel, but not the local traffic.
My problem now is that I don’t know how I make the ipsec policy entries as it is not the possible to exclude subnets from ipsec, just to include. If I make following policy
It would also encrypt the traffic from the local subnet to an other local subnet, or is the some implicit configuration that local subnets are not passed to ipsec.
ps: It would be nice if the 10.4.254.10/24 ip address of the router1 is reachable from the networks behind router 2 if the ipsec tunnel is not up. Just for monitoring (link down vs. tunnel tunnel) and administration of the router.
My problem now is that I don’t know how I make the ipsec policy entries as it is not the possible to exclude subnets from ipsec, just to include. If I make following policy
Sure you can exclude subnets. Just set the action to ‘none’. So you have to make policies for traffic between subnets on the same router (lots of them, sadly), and via an action of ‘none’ exclude the traffic from having encryption applied to it.
You could make this significantly easier on yourself if you changed your IP addressing scheme. The scheme you chose is impossible to aggregate. If you pick your networks differently you only need one policy because you would be able to summarize the entire site in just one network address.
About the IP scheme .. it looks not good in this example but if you've > 100 locations and need separate subnets for different devices it gets quit easy in the data center to sort out the devices as e.g. device class 1 is always with 10.1.x.x and device class 2 10.2.x.x .... no matter which of the 100 locations it is from. And there are some other benefits ... just not for the ip sec tunnel ....
With cisco routers I've a setup where I don't need to define all policies, it is enough that it gets the routing info via EIGRP via the ipsec tunnel .... is something like that possible with mikrotik too?