mirror of
https://git.dn42.dev/wiki/wiki
synced 2025-03-16 12:23:33 +00:00
92 lines
4.1 KiB
Markdown
92 lines
4.1 KiB
Markdown
# IPsec with public key authentication on Mikrotik RouterOS
|
|
## Setup
|
|
### Generate an RSA keypair
|
|
|
|
[admin@mtk1] > /ip ipsec key
|
|
[admin@mtk1] /ip ipsec key> generate-key mykey key-size=4096
|
|
For key bigger than 1024bit this may take a while..
|
|
[admin@mtk1] /ip ipsec key> print
|
|
Flags: P - private-key, R - rsa
|
|
# NAME KEY-SIZE
|
|
0 PR mykey 4096-bit
|
|
|
|
### Exchange public keys with your peer
|
|
1. Export the public key to a file.
|
|
|
|
[admin@mtk1] /ip ipsec key> export-pub-key mykey file-name=mykey.pub
|
|
|
|
[admin@mtk1] /ip ipsec key> /file print where name=mykey.pub
|
|
# NAME TYPE SIZE CREATION-TIME
|
|
2 mykey.pub ssh key 451 jul/20/2014 12:35:33
|
|
|
|
2. Copy the file to your workstation and send it to your peer. The contents of the file should look like this:
|
|
|
|
-----BEGIN PUBLIC KEY-----
|
|
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv4RHohMZP4F5qTJKqoSL
|
|
TqefoZZRt1RVI5dOocjV1pJZnqcXMtHfQ/5+O+igUCAX+yBv0hie+U32FWcy5cQO
|
|
+xaohZW1zFzvlRWVqOpTwdk/993Zmy070T1FzK4kFShsNtxYrtYNheCnakgfXgMg
|
|
23w/35zcof64/ewzF6RuqkTzmccIFCWDuv2IobXTOYAk7G3PGN4xWscvFIroIy5s
|
|
4E8oOmKWVoFErQA6XetJzI+X+knzI3J/6/Pff4Tz7TLxu1m2I0InFaBv1G0+BXnh
|
|
QOvIM7fvs5s0YWaUdT+vz8F0SHtb6Q/IdWc4JJPH/Q2t4HKTkk7FUnvvub2GxVbs
|
|
8QIDAQAB
|
|
-----END PUBLIC KEY-----
|
|
|
|
3. Convert your peer's public key to the PEM format using the [pubkey-converter][pubkey-converter] script, if necessary.
|
|
|
|
[pubkey-converter]: https://github.com/ryanriske/pubkey-converter "Public key conversion script"
|
|
|
|
## Configuration
|
|
### Configure the phase 1 IKE parameters
|
|
In this example, we'll use the following settings:
|
|
|
|
| Key | Value |
|
|
| :------------ | :------------ |
|
|
| Encryption | AES-128 |
|
|
| Hash | HMAC-SHA1 |
|
|
| DH Group | 5 (modp1536) |
|
|
| Lifetime | 28800 seconds |
|
|
| Peer address | 192.0.2.2 |
|
|
| Local address | 192.0.2.1 |
|
|
|
|
1. Copy your peer's PEM-encoded public key to the router and import it. (Hit enter when it asks for a passphrase)
|
|
|
|
[admin@mtk1] /ip ipsec key> import peer-key.pub name=peer-key
|
|
passphrase:
|
|
|
|
[admin@mtk1] /ip ipsec key> print
|
|
Flags: P - private-key, R - rsa
|
|
# NAME KEY-SIZE
|
|
0 PR mykey 4096-bit
|
|
1 R peer-key 4096-bit
|
|
|
|
2. Configure your peer definition to use the public key
|
|
|
|
[admin@mtk1] /ip ipsec peer> add address=192.0.2.2 local-address=192.0.2.1 enc-algorithm=aes-128 hash-algorithm=sha1 dh-group=modp1536 lifetime=28800 key=mykey remote-key=peer-key auth-method=rsa-key
|
|
[admin@mtk1] /ip ipsec peer> print
|
|
Flags: X - disabled
|
|
0 address=192.0.2.2/32 local-address=192.0.2.1 passive=no port=500
|
|
auth-method=rsa-key key=mykey remote-key=peer-key generate-policy=no
|
|
exchange-mode=main send-initial-contact=yes nat-traversal=no
|
|
proposal-check=obey hash-algorithm=sha1 enc-algorithm=aes-128
|
|
dh-group=modp1536 lifetime=8h lifebytes=0 dpd-interval=2m
|
|
dpd-maximum-failures=5
|
|
|
|
3. All done! Configure the phase 2 parameters as you otherwise would.
|
|
|
|
## Full GRE/IPsec example
|
|
# jul/20/2014 13:00:04 by RouterOS 6.15
|
|
# software id = HBCA-0B2J
|
|
#
|
|
/interface gre
|
|
add dscp=inherit local-address=192.0.2.1 mtu=1400 name=gre-tunnel1 \
|
|
remote-address=192.0.2.2
|
|
/ip address
|
|
add address=10.1.2.0/31 interface=gre-tunnel1 network=10.1.2.0
|
|
/ip ipsec proposal
|
|
set [ find default=yes ] lifetime=1h pfs-group=modp1536
|
|
/ip ipsec peer
|
|
add address=192.0.2.2/32 auth-method=rsa-key dh-group=modp1536 key=mykey \
|
|
lifetime=8h local-address=192.0.2.1 remote-key=peer-key
|
|
/ip ipsec policy
|
|
add dst-address=192.0.2.2/32 protocol=gre sa-dst-address=192.0.2.2 \
|
|
sa-src-address=192.0.2.1 src-address=192.0.2.1/32 |