Site-to-Site VPN (3 MikroTik routers)

RouterOS General
1

Link to Reddit thread: https://www.reddit.com/r/mikrotik/comments/m8c31m/sitetosite_vpn_3_mikrotik_routers/

So an ISP wants me to set up a secure site-to-site VPN between A, B, C and ensuring redundancy such that A can reach C if B is down and so on.

Their Diagram

Router A, B, C all have public IP of the same subnet/prefix

They want to set up site-to-site in order to for the internal network of A, B, C to be accessible by each and any of the sites. For example, those in A can access B, those in B can access C and C and access A etc.

So what would be the optimal solution for this? Which VPN protocol can ensure good performance along with redundancy? I’ve looked at MikroTik docs/guides/forums but most of them only talk about IPSec with two sites.

I would definitely need some implementation examples/help on this one.

2

If you use the typical IPSec one… You can add a 3rd site pretty easily.

3

You can also check this example http://forum.mikrotik.com/t/mikrotik-behind-nat-to-mikrotik-ipsec-ike2-with-certs-tunnel-eoip/144952/1 that explains how to use IKE2 with 3 sites.

4

Not knowing the complex subject, I can only ask…

Would it make sense to use MT proprietary Eoip tunneling and create a common network, or is that functionality only useful in a two site scenario??
https://help.mikrotik.com/docs/display/ROS/EoIP

5

Thread solved. IPIP tunnel + IPSec.

6

Hello i try to make a ipip tunel behind a router, which is the ipip port to fw ?