Tak skusmo som vyskusal v labe nejaky setup.. ten gre setup, v transport mode je kvoli natu problem. Ten GRE navyse ktory je vyssie ma v poste zle src ip adresy ..
Setup ktory funguje je esp + tunnel..
R1:
/ip ipsec proposal
set auth-algorithms=sha1 disabled=no enc-algorithms=3des lifetime=30m name=default pfs-group=modp1024
add auth-algorithms=sha1 disabled=no enc-algorithms=3des lifetime=30m name=tunnel-proposal pfs-group=modp1024
/ip ipsec peer
add address=88.146.173.193/32 auth-method=pre-shared-key dh-group=modp1024 disabled=no dpd-interval=5s dpd-maximum-failures=5 enc-algorithm=3des exchange-mode=main generate-policy=no \
hash-algorithm=sha1 lifebytes=0 lifetime=1d my-id-user-fqdn="" nat-traversal=yes port=500 proposal-check=obey secret=password send-initial-contact=yes
/ip ipsec policy
add action=encrypt disabled=no dst-address=192.168.2.0/24 dst-port=any ipsec-protocols=esp level=require priority=0 proposal=tunnel-proposal protocol=all sa-dst-address=\
88.146.173.193 sa-src-address=10.39.9.11 src-address=192.168.1.0/24 src-port=any tunnel=yes
/ip firewall nat
add action=accept chain=srcnat disabled=no dst-address=192.168.2.0/24 src-address=192.168.1.0/24
add action=masquerade chain=srcnat disabled=no out-interface=ether1-gateway
RB:
/ip ipsec proposal
set auth-algorithms=sha1 disabled=no enc-algorithms=3des lifetime=30m name=default pfs-group=modp1024
add auth-algorithms=sha1 disabled=no enc-algorithms=3des lifetime=30m name=tunnel-proposal pfs-group=modp1024
/ip ipsec peer
add address=77.242.87.189/32 auth-method=pre-shared-key dh-group=modp1024 disabled=no dpd-interval=5s dpd-maximum-failures=5 enc-algorithm=3des exchange-mode=main generate-policy=no \
hash-algorithm=sha1 lifebytes=0 lifetime=1d my-id-user-fqdn="" nat-traversal=yes port=500 proposal-check=obey secret=password send-initial-contact=yes
/ip ipsec policy
add action=encrypt disabled=no dst-address=192.168.1.0/24 dst-port=any ipsec-protocols=esp level=require priority=0 proposal=tunnel-proposal protocol=all sa-dst-address=77.242.87.189 \
sa-src-address=172.20.202.100 src-address=192.168.2.0/24 src-port=any tunnel=yes
/ip firewall nat
add action=accept chain=srcnat disabled=no dst-address=192.168.1.0/24 src-address=192.168.2.0/24
add action=masquerade chain=srcnat disabled=no out-interface=ether1-gateway
Treba si este vyriesit MTU ..
Btw skusal som dany setup aj na 5.19, tam to reaguje hodne zle zmazanie SAciek na niektorom z routrov znamena nedosiahnutelny druhy koniec .. proste bug.
Na 5.16 to ide OK, preto odporucam upgrade.
Dufam ze ti to bude fungovat OK.
L.
