Site-to-Site IPSec VPN with MikroTik: Complete Setup

IPSec IKEv2 Site-to-Site VPN on MikroTik

IPSec with IKEv2 provides strong encryption and fast renegotiation. This guide configures a tunnel between two MikroTik routers.

Site A Configuration (HQ)

BASH

# IKEv2 Proposal
/ip ipsec proposal add name=ike2-prop auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=modp2048

# Peer (Site B's public IP)
/ip ipsec peer add name=site-b address=203.0.113.2/32 exchange-mode=ike2

# Identity
/ip ipsec identity add peer=site-b auth-method=pre-shared-key secret=VeryStr0ngPresharedKey

# Policy (encrypt traffic between subnets)
/ip ipsec policy add peer=site-b tunnel=yes sa-src-address=198.51.100.1 sa-dst-address=203.0.113.2 src-address=10.1.0.0/24 dst-address=10.2.0.0/24 proposal=ike2-prop

Site B Configuration (Branch)

Mirror the configuration with swapped addresses:

BASH

/ip ipsec peer add name=site-a address=198.51.100.1/32 exchange-mode=ike2
/ip ipsec identity add peer=site-a auth-method=pre-shared-key secret=VeryStr0ngPresharedKey
/ip ipsec policy add peer=site-a tunnel=yes sa-src-address=203.0.113.2 sa-dst-address=198.51.100.1 src-address=10.2.0.0/24 dst-address=10.1.0.0/24 proposal=ike2-prop

Firewall: Allow IPSec Traffic

BASH

/ip firewall filter add chain=input protocol=udp dst-port=500,4500 action=accept comment="IKEv2"
/ip firewall filter add chain=input protocol=ipsec-esp action=accept comment="IPSec ESP"
/ip firewall raw add chain=prerouting in-interface=ether1 ipsec-policy=in,ipsec action=notrack

Verification

BASH

/ip ipsec active-peers print
/ip ipsec installed-sa print
/ip ipsec statistics print

Troubleshooting

No SA established: Check pre-shared key matches exactly (case-sensitive)
Phase 1 fails: Verify encryption/hash algorithms match on both sides
Traffic not encrypting: Check policy src/dst addresses and route to tunnel

Dead Peer Detection

BASH

/ip ipsec peer set [find name=site-b] dpd-interval=30s dpd-maximum-failures=5

Use DPD to detect and recover from dead tunnels automatically.