CloudLabBox
Try the free demo

MikroTik MTCSE lab 9 of 10

IPsec IKEv2 site-to-site with certificates, NAT and FastTrack

Join Fernvale's head office and the Quayside branch across the Internet with an IKEv2 IPsec tunnel authenticated by certificates from your own CA, then fix the two things that silently break site-to-site IPsec on a working router: source NAT and FastTrack.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 1,280 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCSE RouterOS v7 guided labs, then 09 - IPsec IKEv2 site-to-site with certificates NAT and FastTrack

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
5 vCPU, 1,280 MB
Smallest plan
Lite

The scenario

Fernvale's head office (HQ) and the Quayside branch (BR) both reach the Internet through the same ISP, with masquerade and the usual FastTrack rule. Their LANs use private addresses, so HQ-PC can't reach BR-PC: the Internet doesn't route 10.0.0.0/8. You'll join the two LANs with an IPsec IKEv2 tunnel. HQ already acts as Fernvale's certificate authority (in lab 7 you built one; here you build it again quickly), so the routers prove who they are with certificates, not a shared password.

RouterWANLANPC
HQether1 198.51.100.2/30ether2 10.1.0.1/24HQ-PC 10.1.0.10
BRether1 203.0.113.2/30ether2 10.2.0.1/24BR-PC 10.2.0.10
ISP198.51.100.1 and 203.0.113.1web server 192.0.2.80

What you’ll practise

  • Explain AH and ESP, transport and tunnel mode, and IKE's two phases
  • Build an IKEv2 tunnel with RouterOS profiles, proposals, peers, identities and policies
  • Authenticate both ends with certificates that chain to a CA you trust, instead of a shared secret
  • Read active peers, installed SAs and policy state
  • Exempt site-to-site traffic from masquerade and FastTrack

The tasks

  1. Look before you build
  2. Issue certificates from HQ's CA
  3. Build the IKEv2 tunnel
  4. Make traffic use the tunnel: NAT
  5. Keep tunnel traffic away from FastTrack

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of IPsec IKEv2 site-to-site with certificates NAT and FastTrack5 nodes, 4 links. Every link is listed as text below the diagram.HQISPBRHQ-PCBR-PCether2ether1ether2ether1ether1ether1ether2ether1
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ ether1 to ISP ether1
  • ISP ether2 to BR ether1
  • HQ ether2 to HQ-PC ether1
  • BR ether2 to BR-PC ether1
Nodes in IPsec IKEv2 site-to-site with certificates, NAT and FastTrack, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
BRMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
HQ-PCMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
BR-PCMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCSE RouterOS v7 guided labs.

  3. Open 09 - IPsec IKEv2 site-to-site with certificates NAT and FastTrack and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCSE labs

All MikroTik MTCSE labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.