Thank you for your answer. I have 30 location connected by ipsec with Junipers SRX. I can configure it. Unfortunately because of unstable power supply in location i have problems with juniper hardware and I would like replace it on Mikrotik. I'm beginner in RouterOS, but I have some experience in ipsec. All locations have your own internet access and own nat and router is behind this nat. I have two RB 2011UiAS for test but first i would like to know if it is possible to make 30 ipsec tunnels to central router from locations behind nat. Trafiic is not big, ipsec is rather for manage ruter and devices connected to router. We have no multiple tunel behind the same nat. Central router have static and public internet access. I thought about pure ipsec but it is only plan for know. Any suggestions will be nice!