ros routeros ikev2 ipsec 基础上跑GRE再跑ospf，适合点到点的ipsec情况

admin

网络环境，客户端是路由下面的子网掩码的ROS（也就是没有公网IP，为城域网的ROS），服务端是具有公网IP的ROS。

该文章可以解决运营商对于只有城域网IP的ROS，对于各种隧道协议全部限速的问题，具体限速情况：

拓扑图：

服务端:

创建一个回环接口，这个ip用于创建ipsec隧道的服务端IP

1. /interface bridge
   
2. add name=loopback-ipsec
   
3. /ip address
   
4. add address=172.16.99.1 interface=loopback-ipsec network=172.16.99.1
   
5. /ip ipsec profile
   
6. add enc-algorithm=aes-256 hash-algorithm=sha256 name=ike2
   
7. /ip ipsec proposal
   
8. add auth-algorithms=sha256 enc-algorithms=aes-256-cbc name=ike2 pfs-group=none

复制代码

子网掩码用30位，因为是点到点，那么下发IP，包括服务端就2个ip

1. /ip ipsec mode-config
   
2. add address=172.16.99.2 address-prefix-length=30 name=ike2-conf split-include=172.16.99.1/32 system-dns=no
   
3. /ip ipsec policy group
   
4. add name=ike2-policies
   
5. /ip ipsec policy
   
6. disable numbers=0
   
7. /ip ipsec policy
   
8. add dst-address=172.16.99.2/32 group=ike2-policies proposal=ike2 src-address=172.16.99.1/32 template=yes
   
9. /ip ipsec peer
   
10. add exchange-mode=ike2 name=ike2 passive=yes profile=ike2
    
11. /ip ipsec identity
    
12. add generate-policy=port-strict mode-config=ike2-conf peer=ike2 secret=密码 policy-template-group=ike2-policies

复制代码

客户端:

1. /ip ipsec profile
   
2. add enc-algorithm=aes-256 hash-algorithm=sha256 name=ike2-rw
   
3. /ip ipsec proposal
   
4. add auth-algorithms=sha256 enc-algorithms=aes-256-cbc name=ike2-rw pfs-group=none
   
5. /ip ipsec policy group
   
6. add name=ike2-rw
   
7. /ip ipsec policy
   
8. disable numbers=0
   
9. /ip ipsec policy
   
10. add dst-address=172.16.99.1/32 src-address=172.16.99.2/32 group=ike2-rw proposal=ike2-rw template=yes
    
11. /ip ipsec peer
    
12. add address=ipsec服务端公网IP/32 exchange-mode=ike2 name=ike2-rw-client profile=ike2-rw

复制代码

请注意，虽然我们客户端没有配置mode-config，但是这里必须写上默认的request-only

1. /ip ipsec identity
   
2. add generate-policy=port-strict mode-config=request-only peer=ike2-rw-client policy-template-group=ike2-rw secret=密码

复制代码

上述就可以把ipsec隧道建立起来了，然后你再创建两边的GRE，同时创建隧道IP

服务端：

1. /interface gre
   
2. add local-address=172.16.99.1 name=gre-ipsec-to-yanfasanqu remote-address=172.16.99.2
   
3. /ip address
   
4. add address=172.16.101.1 interface=gre-ipsec-to-yanfasanqu network=172.16.101.2

复制代码

最后起OSPF，点到点网络直接填对端IP

1. /routing ospf network
   
2. add area=backbone network=172.16.101.2/32

复制代码

客户端

1. /interface gre
   
2. add local-address=172.16.99.2 name=gre-ipsec-to-hangzhou remote-address=172.16.99.1
   
3. /ip address
   
4. add address=172.16.101.2 interface=gre-ipsec-to-hangzhou network=172.16.101.1
   
5. /routing ospf network
   
6. add area=backbone network=172.16.101.1/32

复制代码