IPSec IKEv2 VPN in MikroTik: Site-to-Site Configuration

Basic IPsec IKEv2 VPN Setup on MikroTik

IPsec (Internet Protocol Security) is a standard for encrypting and authenticating IP traffic. IKEv2 is the modern key exchange protocol used with IPsec — it is faster, more secure, and more reliable than the older IKEv1. This guide covers a simple setup for beginners.

IPsec Concepts (Simplified)

• Phase 1 (IKE SA) — the two routers authenticate each other and agree on encryption parameters. Configured via "peers" and "proposals."
• Phase 2 (IPsec SA) — the actual data tunnel is established. Configured via "policies."
• Pre-shared Key (PSK) — a shared password used to authenticate both sides (simplest method for beginners)
• Proposal — the set of encryption algorithms to use (e.g., AES-256, SHA-256)

Scenario: Site-to-Site IKEv2 VPN

We will connect two offices:

• Site A (Router A): WAN IP 203.0.113.1, LAN 192.168.1.0/24
• Site B (Router B): WAN IP 198.51.100.1, LAN 192.168.2.0/24

Goal: devices on both LANs can communicate securely through the VPN.

Configuration on Router A

Step 1: Create an IPsec Proposal

/ip ipsec proposal add name=prop-ikev2   auth-algorithms=sha256   enc-algorithms=aes-256-cbc   lifetime=1h   pfs-group=modp2048

Step 2: Create a Peer

/ip ipsec peer add name=site-b-peer   address=198.51.100.1   exchange-mode=ike2   profile=default

Step 3: Create an Identity (Pre-Shared Key)

/ip ipsec identity add peer=site-b-peer   auth-method=pre-shared-key   secret=MyStrongSharedKey123!

Step 4: Create a Policy

The policy defines which traffic should be encrypted:

/ip ipsec policy add src-address=192.168.1.0/24   dst-address=192.168.2.0/24   peer=site-b-peer   proposal=prop-ikev2   action=encrypt   tunnel=yes

Step 5: Disable NAT for VPN Traffic

Add a NAT bypass rule so VPN traffic is not masqueraded:

/ip firewall nat add chain=srcnat src-address=192.168.1.0/24   dst-address=192.168.2.0/24 action=accept place-before=0

This rule must be placed before the masquerade rule.

Configuration on Router B

Mirror the configuration with reversed addresses:

Proposal (same as Router A)

/ip ipsec proposal add name=prop-ikev2   auth-algorithms=sha256   enc-algorithms=aes-256-cbc   lifetime=1h   pfs-group=modp2048

Peer

/ip ipsec peer add name=site-a-peer   address=203.0.113.1   exchange-mode=ike2   profile=default

Identity

/ip ipsec identity add peer=site-a-peer   auth-method=pre-shared-key   secret=MyStrongSharedKey123!

Policy (reversed src/dst)

/ip ipsec policy add src-address=192.168.2.0/24   dst-address=192.168.1.0/24   peer=site-a-peer   proposal=prop-ikev2   action=encrypt   tunnel=yes

NAT Bypass

/ip firewall nat add chain=srcnat src-address=192.168.2.0/24   dst-address=192.168.1.0/24 action=accept place-before=0

Verifying the IPsec Tunnel

Check Active SAs (Security Associations)

/ip ipsec active-peers print

You should see the peer with status established.

Check Installed Policies

/ip ipsec policy print

Look for ph2-count: 1 which means Phase 2 is established.

Check Statistics

/ip ipsec statistics print

Shows packets encrypted/decrypted — if these counters increase when you ping across the tunnel, it is working.

Testing the Tunnel

From a device on Site A's LAN (192.168.1.x), ping a device on Site B:

ping 192.168.2.1

If it works, the tunnel is up. If not, check:

/log print where topics~"ipsec"

IPsec Profile Configuration

The default profile works for most setups, but you can customize:

/ip ipsec profile add name=ikev2-profile   dh-group=modp2048   enc-algorithm=aes-256   hash-algorithm=sha256   lifetime=8h   nat-traversal=yes

Enable nat-traversal=yes if either router is behind NAT.

Firewall for IPsec

Make sure these ports/protocols are allowed on the WAN interface:

/ip firewall filter add chain=input protocol=udp dst-port=500 action=accept comment="IKE"
/ip firewall filter add chain=input protocol=udp dst-port=4500 action=accept comment="IPsec NAT-T"
/ip firewall filter add chain=input protocol=ipsec-esp action=accept comment="IPsec ESP"

Summary

• IPsec IKEv2 provides encrypted tunnels between sites
• Configure: proposal → peer → identity → policy on each router
• Src/dst addresses in policies are reversed on each end
• Add NAT bypass before the masquerade rule
• Verify with /ip ipsec active-peers print
• Use nat-traversal=yes if behind NAT
• Check logs with /log print where topics~"ipsec" for troubleshooting