VPN IPSec سایت به سایت با MikroTik: راه‌اندازی کامل

# پروپوزال IKEv2
/ip ipsec proposal add name=ike2-prop auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=modp2048

# Peer (آدرس عمومی سایت B)
/ip ipsec peer add name=site-b address=203.0.113.2/32 exchange-mode=ike2

# هویت
/ip ipsec identity add peer=site-b auth-method=pre-shared-key secret=VeryStr0ngPresharedKey

# پالیسی (رمزگذاری ترافیک بین زیرشبکه‌ها)
/ip ipsec policy add peer=site-b tunnel=yes sa-src-address=198.51.100.1 sa-dst-address=203.0.113.2 src-address=10.1.0.0/24 dst-address=10.2.0.0/24 proposal=ike2-prop

/ip ipsec peer add name=site-a address=198.51.100.1/32 exchange-mode=ike2
/ip ipsec identity add peer=site-a auth-method=pre-shared-key secret=VeryStr0ngPresharedKey
/ip ipsec policy add peer=site-a tunnel=yes sa-src-address=203.0.113.2 sa-dst-address=198.51.100.1 src-address=10.2.0.0/24 dst-address=10.1.0.0/24 proposal=ike2-prop

/ip firewall filter add chain=input protocol=udp dst-port=500,4500 action=accept comment="IKEv2"
/ip firewall filter add chain=input protocol=ipsec-esp action=accept comment="IPSec ESP"

/ip ipsec active-peers print
/ip ipsec installed-sa print
/ip ipsec statistics print

/ip ipsec peer set [find name=site-b] dpd-interval=30s dpd-maximum-failures=5