Need help to configure two IPSec Tunnels in chain

hkusulja · October 16, 2019, 5:18pm

Plain IPSec tunnels can be confusing at first. Let’s say you have:
/ip ipsec policy
add <other options> src-address=<local subnet> dst-address=<remote subnet> \
    sa-src-address=<local router address> sa-dst-address=<remote router address>
If you watch packets in firewall (in different chains), you’ll see that traffic from to is routed to internet. In postrouting, it will be going out via WAN interface. It looks completely wrong, right?

But before it really happens, IPSec policy kicks in, intercepts the packet, stops it from going further, encrypts it and sends it to (with source address set to ). You can see what happens step by step here: https://wiki.mikrotik.com/wiki/Manual:Packet_Flow_v6#Ipsec_Encryption.2FDecryption

Once you undestand this, everything should be clear.

Thank you, this is clear, however I am not clear about usage of “peer” and “proposial” for this particular policy SiteC>SiteA, over SiteC .., for what is peer / proposial used then here and how or this info is irelevantan. (but it is mandatory parameter in ipsec policy) …