使用RouterOS与网御防火墙建立IPSEC隧道

口1其1ActionApplyCurTin已nt*Ternplat口1其1ActionApplyCurTin已nt*Ternplat172.31.255.0/24；IlsacFolic?<1T2.31.255.0/24：0->10.2IRIPSEC，增加ipsecpolicy,填写本端保护地址与对端保护地址填好本地地址与对端地址（实验环境为一端公网IP,另一端NAT后地址，从222.*.*.*静态映射到172.16.0.200）其中proposal为第二阶段使用的策略使用RouterOS与网御防火墙建立IPSEC隧道为满足外地办事机构与总部的业务需求，需要利用现有网御防火墙与RouterOS建立IPsec隧道，经过多次试验，终于协商成功。1、RouterOS端配置A-ctLorLEncryptLevelreiiuireA-ctLorLEncryptLevelreiiuireIPsecPolicy<172.31.2F5.0/24:0->10.2...回田OKIFsecFrotocolSA.Src.Alilreee：172.16.IJ.2IJUtt：rL：ible<1s:60Template设置第一阶段策略，认证方法选“预共享密钥”主模式，注意在ID设置时，RouterOS有一项隐藏的参数，就是MYID选择为Auto并不等于没有ID,默认ID是ROS接口IP就是在这个问题上看着选择是不验证ID,总是协商不通过，来回纠结了好几天，最后通过debug工具找到了原因，日志见文章最后。测试了很多次，只有使用“主模式”A端MYID设置为Auto,B端设置为IP地址时可以通。选择好算法，注意Modp768对应防火墙的DH1,Modp1024对应DH2,Modp1024对应DH3

图设置二阶段算法Auth・Algoritluris*[TiduN：dJTlC!:增加ROS往外、转发的流量允许出入设备配置IPSECvpn的nonat地址段。2、网御防火墙设置设置VPN规则设置IKE规则，注意ID要填写成对应ROS接口IP增加网关隧道Leadsec_FW>vpn_debug_info.shSep1122:46:25venuspluto[16601]:freeallexisting:CAcertcertsSep1122:46:25venuspluto[16601]:Changedpathtodirectory'/etc/ipsec.d/aacerts'Sep1122:46:25venuspluto[16601]:freeallexisting:AAcertcertsSep1122:46:25venuspluto[16601]:Changedpathtodirectory'/etc/ipsec.d/ocspcerts'Sep1122:46:25venuspluto[16601]:freeallexisting:OCSPcertcertsSep1122:46:25venuspluto[16601]:Changingtodirectory'/etc/ipsec.d/crls'Sep1122:46:25venuspluto[16601]:Warning:emptydirectorySep1122:46:25venuspluto[16601]:addedconnectiondescription"gateway1"Sep1122:46:25venuspluto[16601]:"gateway1":deletingconnectionSep1122:46:25venuspluto[16601]:addedconnectiondescription"gateway1"Sep1122:46:41venuspluto[16601]:"gateway1"#306:MainmodepeerIDisID_IPV4_ADDR:'172.16.0.200'Sep1122:46:41venuspluto[16601]:"gateway1"#306:nosuitableconnectionforpeer'172.16.0.200'Sep1122:46:41venuspluto[16601]:"gateway1"#306:sendingencryptednotificationINVALID_ID_INFORMATIONto222.*.*.*:500Sep1122:46:51venuspluto[16601]:"gateway1"#306:MainmodepeerIDisID_IPV4_ADDR:'172.16.0.200'Sep1122:46:51venuspluto[16601]:"gatewayl"#306:nosuitableconnectionforpeer'172.16.0.200'Sep1122:46:51venuspluto[16601]:"gateway1"#306:sendingencryptednotificationINVALID_ID_INFORMATIONto222.*.*.*:500Sep1122:47:00venussshd[20977]:reprocessconfigline79:UnsupportedoptionGSSAPIAuthenticationSep1122:47:00venussshd[20977]:Invaliduserubntfrom218.14.157.178Sep1122:47:00venussshd[20977]:input_userauth_request:invaliduserubnt[preauth]Sep1122:47:00venussshd[20977]:error:CouldnotgetshadowinformationforNOUSERSep1122:47:00venussshd[20977]:Failedpasswordforinvaliduserubntfrom218.14.157.178port43638ssh2Sep1122:47:00venussshd[20977]:Connectionclosedby218.14.157.178[preauth]Sep1122:47:01venuspluto[16601]:"gateway1"#306:MainmodepeerIDisID_IPV4_ADDR:'172.16.0.200'Sep1122:47:01venuspluto[16601]:"gateway1"#306:nosuitableconnectio