IPSec RouterOS PfSense

IPSec Site-To-Site yhteys RouterOS:stä PfSenseen.

Reitittimien kokoonpano:

RouterOS 6.38:

• ETH1 1.1.1.1/24
• ETH2 10.0.0.1/24

PfSense 2.3.2-RELEASE-p1

• WAN 1.1.1.2/24
• LAN 192.168.1.0/24

RouterOS:ssä konfiguraatiot

Määritä RouterOS:ään oikeat proposalit

 /ip ipsec set default auth-algorithms=sha1 enc-algorithms=aes-128-cbc lifetime=01:00:00 pfs-group=modp1024

Konfiguroi peer (phase1)

 /ip ipsec peer add address=1.1.1.2 port=500 secret=salasana123 policy-template-group=default send-initial-contact=yes generate-policy=port-strict lifetime=08:00:00 proposal-check=obey dpd-interval=120 dpd-maximum-failures=5 hash-algorithm=sha1 enc-algorithm=aes-256 dh-group=modp1024

Konfiguroi policy (phase2)

 /ip ipsec policy add src-address=10.0.0.0/24 dst-address=192.168.1.0/24 protocol=all action=encrypt level=require ipsec-protocols=esp sa-src-address=1.1.1.1 sa-dst-address=1.1.1.2 proposal=default 

Lisää palomuuriin sääntö

 /ip firewall nat add chain=srcnat action=accept place-before=0 src-address=10.0.0.0/24 dst-address=192.168.1.0/24