godinich consulting - mikrotikmum.mikrotik.com/presentations/us15/godinichconsulting_mum.pdf ·...
TRANSCRIPT
![Page 1: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/1.jpg)
Godinich Consulting
VPN's Between Mikrotik and 3rd Party Devices
![Page 2: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/2.jpg)
Vince Godinich
experience
![Page 3: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/3.jpg)
TOPICS•PPTP Mikrotik Client to Cisco Server•IPSEC Shrew Client To Mikrotikrouter•IPSEC Mikrotik router to Cisco IOS router
![Page 4: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/4.jpg)
PPTP Mikrotik Client to Cisco Server
•Configure a Mikrotik router to act as a PPTP client connecting to a Cisco PPTP server to connect remote lans•Allows replacement of a Cisco branch router with a MikroTik router without changing or replacing existing Cisco main router
![Page 5: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/5.jpg)
PPTP Mikrotik Client to Cisco Server
internet
Ether 110.0.0.1/24
Ether 1 10.0.0.2/24
Site A PC 192.168.1.79/24
Site B Server 192.168.0.2/24
Ether 2192.168.0.1/24
Ether 2 192.168.1.1/24
Mikrotik RouterCisco Router
![Page 6: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/6.jpg)
PPTP Mikrotik Client to Cisco Server
internet
Ether 110.0.0.1/24
Ether 1 10.0.0.2/24
Site A PC 192.168.1.79/24
Site B Server 192.168.0.2/24
Ether 2192.168.0.1/24
Ether 2 192.168.1.1/24
Mikrotik RouterCisco Router
PPTP TUNNELPPTP TUNNEL
![Page 7: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/7.jpg)
PPTP Mikrotik Client to Cisco Server
internet
Virtual‐Template 1192.168.79.1
pptp‐out 1 192.168.79.2
Site A PC 192.168.1.79/24
Site B Server 192.168.0.2/24
Ether 2192.168.0.1/24
Ether 2 192.168.1.1/24
Mikrotik RouterCisco Router
PPTP TUNNELPPTP TUNNEL
![Page 8: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/8.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 9: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/9.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 10: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/10.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 11: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/11.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 12: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/12.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 13: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/13.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 14: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/14.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 15: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/15.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 16: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/16.jpg)
PPTP Mikrotik Client to Cisco Server
• aaa new‐model
• aaa authentication ppp default local
• vpdn enable
• vpdn‐group 1
• accept‐dialin
• protocol pptp
• virtual‐template 1
• l2tp tunnel timeout no‐session 15
• username pptp_branch password 0 1234
![Page 17: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/17.jpg)
PPTP Mikrotik Client to Cisco Server
• interface Virtual‐Template1• ip address 192.168.79.1 255.255.255.0• peer default ip address pool PPTP_POOL• no keepalive• ppp encrypt mppe 128 required• ppp authentication ms‐chap‐v2• ip local pool PPTP_POOL 192.168.79.2•
![Page 18: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/18.jpg)
PPTP Mikrotik Client to Cisco Server
• ip nat inside source list nonat interface FastEthernet0/0 overload• ip route 192.168.1.0 255.255.255.0 192.168.79.2• ip access‐list extended nonat• deny ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255• permit ip 192.168.1.0 0.0.0.255 any
![Page 19: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/19.jpg)
PPTP Mikrotik Client to Cisco Server
internet
Ether 110.0.0.1/24
Ether 1 10.0.0.2/24
Site A PC 192.168.1.79/24
Site B Server 192.168.0.2/24
Ether 2192.168.0.1/24
Ether 2 192.168.1.1/24
Mikrotik RouterCisco Router
Ping
![Page 20: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/20.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 21: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/21.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 22: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/22.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 23: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/23.jpg)
PPTP Mikrotik Client to Cisco Server
![Page 24: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/24.jpg)
PPTP Mikrotik Client to Cisco Server
• /interface pptp‐client• add allow=mschap2 connect‐to=10.0.0.1 disabled=no mrru=1600 name=pptp‐out1 \
• password=1234 user=pptp_branch
• /ppp profile• set 1 use‐encryption=required
• /ip firewall nat• add chain=srcnat dst‐address=192.168.0.0/24 out‐interface=ether2
![Page 25: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/25.jpg)
IPSEC Shrew Client To Mikrotik
• Configure a Shrew client on remote PC to connect to a Mikrotik router• and access internal lan network• Eliminates need for Microsoft VPN client• Enables one client to be used for remote access to Mikrotik and Cisco
devices eliminating need for a Cisco VPN Client• Easy to import existing Cisco VPN profiles into Shrew client • Allows for ease of migration from Cisco devices to Mikrotik routers
![Page 26: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/26.jpg)
IPSEC Shrew Client To Mikrotik
internet
Ether 110.0.0.1/24
10.0.0.2/24
Remote PC
Site A Server 10.10.0.2
Ether 210.10.0.2/22
Mikrotik Router
![Page 27: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/27.jpg)
IPSEC Shrew Client To Mikrotik
• www.shrew.net/download/vpn
![Page 28: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/28.jpg)
IPSEC Shrew Client To Mikrotik
![Page 29: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/29.jpg)
IPSEC Shrew Client To Mikrotik
![Page 30: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/30.jpg)
IPSEC Shrew Client To Mikrotik
![Page 31: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/31.jpg)
IPSEC Shrew Client To Mikrotik
![Page 32: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/32.jpg)
IPSEC Shrew Client To Mikrotik
![Page 33: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/33.jpg)
IPSEC Shrew Client To Mikrotik
![Page 34: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/34.jpg)
IPSEC Shrew Client To Mikrotik
![Page 35: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/35.jpg)
IPSEC Shrew Client To Mikrotik
![Page 36: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/36.jpg)
IPSEC Shrew Client To Mikrotik
![Page 37: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/37.jpg)
IPSEC Shrew Client To Mikrotik
![Page 38: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/38.jpg)
IPSEC Shrew Client To Mikrotik
![Page 39: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/39.jpg)
IPSEC Shrew Client To Mikrotik
![Page 40: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/40.jpg)
IPSEC Shrew Client To Mikrotik
![Page 41: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/41.jpg)
IPSEC Shrew Client To Mikrotik
![Page 42: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/42.jpg)
IPSEC Shrew Client To Mikrotik
n:version:4n:network‐ike‐port:500n:network‐mtu‐size:1380n:client‐addr‐auto:1n:network‐natt‐port:4500n:network‐natt‐rate:15n:network‐frag‐size:540n:network‐dpd‐enable:0n:client‐banner‐enable:0n:network‐notify‐enable:0n:client‐dns‐used:0n:client‐dns‐auto:0n:client‐dns‐suffix‐auto:0n:client‐splitdns‐used:0n:client‐splitdns‐auto:0n:client‐wins‐used:0n:client‐wins‐auto:1n:phase1‐dhgroup:2n:phase1‐life‐secs:86400
n:phase1‐life‐kbytes:0n:vendor‐chkpt‐enable:0n:phase2‐life‐secs:3600n:phase2‐life‐kbytes:0n:policy‐nailed:0n:policy‐list‐auto:0n:phase1‐keylen:128n:phase2‐keylen:128s:network‐host:10.10.0.1s:client‐auto‐mode:pulls:client‐iface:virtuals:network‐natt‐mode:disables:network‐frag‐mode:disable
s:auth‐method:mutual‐psks:ident‐client‐type:addresss:ident‐server‐type:addressb:auth‐mutual‐psk:Y3RiNjUxs:phase1‐exchange:mains:phase1‐cipher:aess:phase1‐hash:sha1s:phase2‐transform:esp‐aess:phase2‐hmac:sha1s:ipcomp‐transform:disabledn:phase2‐pfsgroup:2s:policy‐level:requires:policy‐list‐include:10.10.0.0 / 255.255.252.0
![Page 43: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/43.jpg)
IPSEC Shrew Client To Mikrotik
![Page 44: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/44.jpg)
IPSEC Shrew Client To Mikrotik
![Page 45: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/45.jpg)
IPSEC Shrew Client To Mikrotik
internet
Ether 110.0.0.1/24
10.0.0.2/24
Remote PC
Site A Server 10.10.0.2
Ether 210.10.0.2/22
Mikrotik Router
![Page 46: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/46.jpg)
IPSEC Shrew Client To Mikrotik
internet
Ether 110.0.0.1/24
10.0.0.2/24
Remote PC
Site A Server 10.10.0.2
Ether 210.10.0.2/22
Mikrotik Router
PING
![Page 47: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/47.jpg)
IPSEC Shrew Client To Mikrotik
![Page 48: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/48.jpg)
IPSEC Cisco IOS or ASA To Mikrotik
•Configure an IPSEC VPN between a Cisco IOS router or ASA and a Mikrotikrouter
•Allows replacement of a Cisco branch router or ASA with a MikroTik router
without changing or replacing existing Cisco main router
![Page 49: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/49.jpg)
IPSEC Cisco IOS To Mikrotik
internet
Ether 0/010.0.0.2/24
Ether 1 10.0.0.1/24
Site A PC 192.168.1.2/24
Site B Server 192.168.0.2/24
Ether 0/1192.168.0.1/24
Ether 2 192.168.1.1/24
Cisco router
Mikrotik router
![Page 50: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/50.jpg)
IPSEC Cisco IOS To Mikrotik
IPSEC
![Page 51: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/51.jpg)
IPSEC Cisco IOS To Mikrotik
Local lan subnet
Remote lan subnet
![Page 52: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/52.jpg)
IPSEC Cisco IOS To Mikrotik
Local wan address
Remote wan address
![Page 53: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/53.jpg)
IPSEC Cisco IOS To Mikrotik
Remote wan address
PRE SHARED PASSWORD
![Page 54: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/54.jpg)
IPSEC Cisco IOS To Mikrotik
![Page 55: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/55.jpg)
IPSEC Cisco IOS To Mikrotik
Local lan subnet
Remote lan subnet
![Page 56: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/56.jpg)
IPSEC Cisco IOS To Mikrotik
![Page 57: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/57.jpg)
IPSEC Cisco IOS To Mikrotik
crypto isakmp policy 1encr aesauthentication pre‐sharegroup 2crypto isakmp key 1234 address 10.0.0.2 no‐xauth!!crypto ipsec transform‐set remote esp‐aes esp‐sha‐hmac!crypto map remote 5 ipsec‐isakmpset peer 10.0.0.2set transform‐set remoteset pfs group2match address remote!
interface FastEthernet0/0ip address 10.0.0.1 255.255.255.0ip nat outsideduplex autospeed autocrypto map remote!ip nat inside source list nonat interface FastEthernet0/0 overloadip access‐list extended nonatdeny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255permit ip 192.168.0.0 0.0.0.255 any!ip access‐list extended remotepermit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255!
![Page 58: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/58.jpg)
IPSEC Cisco IOS To Mikrotik
vince_1841#sh crypto isakmp saIPv4 Crypto ISAKMP SAdst src state conn‐id status10.0.0.1 10.0.0.2 QM_IDLE 1003 ACTIVE
![Page 59: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/59.jpg)
IPSEC Cisco IOS To Mikrotik
•vince_1841#sh crypto ipsec sainterface: FastEthernet0/0Crypto map tag: remote, local addr 10.0.0.1
protected vrf: (none)local ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)current_peer 10.0.0.2 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 121, #pkts encrypt: 121, #pkts digest: 121#pkts decaps: 124, #pkts decrypt: 124, #pkts verify: 124#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0
![Page 60: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/60.jpg)
IPSEC Cisco IOS To Mikrotik
local crypto endpt.: 10.0.0.1, remote crypto endpt.: 10.0.0.2path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0current outbound spi: 0x23D508(2348296)PFS (Y/N): Y, DH group: group2
inbound esp sas:spi: 0x89A2A46B(2309137515)transform: esp‐aes esp‐sha‐hmac ,in use settings ={Tunnel, }conn id: 2003, flow_id: FPGA:3, sibling_flags 80000046, crypto map: remotesa timing: remaining key lifetime (k/sec): (4533419/2928)IV size: 16 bytesreplay detection support: YStatus: ACTIVE
![Page 61: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/61.jpg)
IPSEC Cisco IOS To Mikrotik
vince_1841#sh crypto isakmp saIPv4 Crypto ISAKMP SAdst src state conn‐id status10.0.0.1 10.0.0.2 QM_IDLE 1003 ACTIVE
![Page 62: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/62.jpg)
IPSEC Cisco ASA To Mikrotik
internet
Outside10.0.0.1/24
Ether 1 10.0.0.2/24
Site A PC 192.168.0.2/24
Site B Server 192.168.1.79/24
Inside192.168.1.1/24
Ether 2 192.168.0.1/24
Cisco ASA
Mikrotik router
![Page 63: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/63.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 64: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/64.jpg)
IPSEC Cisco ASA To Mikrotik
Local lan subnet
Remote lan subnet
![Page 65: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/65.jpg)
IPSEC Cisco ASA To Mikrotik
Source Wan Address
Remote Wan Address
![Page 66: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/66.jpg)
IPSEC Cisco ASA To Mikrotik
Remote Wan Address
![Page 67: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/67.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 68: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/68.jpg)
IPSEC Cisco ASA To Mikrotik
Local lan subnet
Remote lan subnet
Srcnat
![Page 69: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/69.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 70: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/70.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 71: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/71.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 72: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/72.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 73: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/73.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 74: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/74.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 75: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/75.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 76: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/76.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 77: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/77.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 78: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/78.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 79: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/79.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 80: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/80.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 81: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/81.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 82: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/82.jpg)
IPSEC Cisco ASA To Mikrotik
![Page 83: Godinich Consulting - MikroTikmum.mikrotik.com/presentations/US15/godinichconsulting_mum.pdf · Godinich Consulting VPN's Between Mikrotik and ... IPSEC Cisco IOS or ASA To Mikrotik](https://reader033.vdocuments.site/reader033/viewer/2022052302/5a7b5d837f8b9a66798bf7b4/html5/thumbnails/83.jpg)
IPSEC Cisco ASA To Mikrotik