VPN IPSec IKEv2 در MikroTik: پیکربندی سایت به سایت

/ip ipsec proposal add name=prop-ikev2   auth-algorithms=sha256   enc-algorithms=aes-256-cbc   lifetime=1h   pfs-group=modp2048

/ip ipsec peer add name=site-b-peer   address=198.51.100.1   exchange-mode=ike2   profile=default

/ip ipsec identity add peer=site-b-peer   auth-method=pre-shared-key   secret=MyStrongSharedKey123!

/ip ipsec policy add src-address=192.168.1.0/24   dst-address=192.168.2.0/24   peer=site-b-peer   proposal=prop-ikev2   action=encrypt   tunnel=yes

/ip firewall nat add chain=srcnat src-address=192.168.1.0/24   dst-address=192.168.2.0/24 action=accept place-before=0

/ip ipsec peer add name=site-a-peer address=203.0.113.1 exchange-mode=ike2 profile=default
/ip ipsec identity add peer=site-a-peer auth-method=pre-shared-key secret=MyStrongSharedKey123!
/ip ipsec policy add src-address=192.168.2.0/24 dst-address=192.168.1.0/24   peer=site-a-peer proposal=prop-ikev2 action=encrypt tunnel=yes
/ip firewall nat add chain=srcnat src-address=192.168.2.0/24   dst-address=192.168.1.0/24 action=accept place-before=0

/ip ipsec active-peers print

/ip ipsec statistics print

/ip firewall filter add chain=input protocol=udp dst-port=500 action=accept
/ip firewall filter add chain=input protocol=udp dst-port=4500 action=accept
/ip firewall filter add chain=input protocol=ipsec-esp action=accept