I'm trying to setup a basic ipsec responder with my mikrotik, running on v6.45.3.
The mikrotik router is the responder, and the initiators will be linux PCs with strongswan. The have to get a dynamic address from the responder.
First, I set up an ip pool:
then a mode config:
/ip pool add name=23-2 ranges=172.23.2.101-172.23.2.150
then a peer and an identity
/ip ipsec mode-config add address-pool=23-1 name=cfg1 system-dns=no
and my policy:
/ip ipsec peer add address=192.168.88.5/32 exchange-mode=ike2 local-address=192.168.88.1 name=test2 passive=yes /ip ipsec identity add mode-config=cfg1 peer=test2 remote-id=fqdn:testttt secret=blablabla
my remote client is now able to connect to my mikrotik, but it does not get an ip from the pool:
/ip ipsec policy add dst-address=172.23.1.0/24 peer=test2 sa-dst-address=192.168.88.5 sa-src-address=192.168.88.1 src-address=172.23.1.0/24 tunnel=yes
[admin@MikroTik] > /ip ipsec active-peers print Flags: R - responder, N - natt-peer # ID STATE UPTIME PH2-TOTAL REMOTE-ADDRESS DYNAMIC-ADDRESS 0 R testttt established 9s 192.168.88.5
on the client side, I get a ts_unacceptable error:
charon: 10[IKE] received TS_UNACCEPTABLE notify, no CHILD_SA built
What could be wrong ? isn't it the way to configure an ipsec server ?