IPsec with public key authentication on Mikrotik RouterOS


Generate an RSA keypair

[admin@mtk1] > /ip ipsec key
[admin@mtk1] /ip ipsec key> generate-key mykey key-size=4096
For key bigger than 1024bit this may take a while..
[admin@mtk1] /ip ipsec key> print
Flags: P - private-key, R - rsa
 #    NAME                                                             KEY-SIZE
 0 PR mykey                                                            4096-bit

Exchange public keys with your peer

  1. Export the public key to a file.
[admin@mtk1] /ip ipsec key> export-pub-key mykey file-name=mykey.pub

[admin@mtk1] /ip ipsec key> /file print where name=mykey.pub
 # NAME                   TYPE                        SIZE CREATION-TIME
 2 mykey.pub              ssh key                      451 jul/20/2014 12:35:33
  1. Copy the file to your workstation and send it to your peer. The contents of the file should look like this:
-----END PUBLIC KEY-----
  1. Convert your peer's public key to the PEM format using the pubkey-converter script, if necessary.


Configure the phase 1 IKE parameters

In this example, we'll use the following settings:

Key Value
Encryption AES-128
DH Group 5 (modp1536)
Lifetime 28800 seconds
Peer address
Local address
  1. Copy your peer's PEM-encoded public key to the router and import it. (Hit enter when it asks for a passphrase)
[admin@mtk1] /ip ipsec key> import peer-key.pub name=peer-key

[admin@mtk1] /ip ipsec key> print
Flags: P - private-key, R - rsa
 #    NAME                                                             KEY-SIZE
 0 PR mykey                                                            4096-bit
 1  R peer-key                                                         4096-bit
  1. Configure your peer definition to use the public key
[admin@mtk1] /ip ipsec peer> add address= local-address= enc-algorithm=aes-128 hash-algorithm=sha1 dh-group=modp1536 lifetime=28800 key=mykey remote-key=peer-key auth-method=rsa-key
[admin@mtk1] /ip ipsec peer> print
Flags: X - disabled
 0   address= local-address= passive=no port=500
     auth-method=rsa-key key=mykey remote-key=peer-key generate-policy=no
     exchange-mode=main send-initial-contact=yes nat-traversal=no
     proposal-check=obey hash-algorithm=sha1 enc-algorithm=aes-128
     dh-group=modp1536 lifetime=8h lifebytes=0 dpd-interval=2m
  1. All done! Configure the phase 2 parameters as you otherwise would.

Full GRE/IPsec example

# jul/20/2014 13:00:04 by RouterOS 6.15
# software id = HBCA-0B2J
/interface gre
add dscp=inherit local-address= mtu=1400 name=gre-tunnel1 \
/ip address
add address= interface=gre-tunnel1 network=
/ip ipsec proposal
set [ find default=yes ] lifetime=1h pfs-group=modp1536
/ip ipsec peer
add address= auth-method=rsa-key dh-group=modp1536 key=mykey \
    lifetime=8h local-address= remote-key=peer-key
/ip ipsec policy
add dst-address= protocol=gre sa-dst-address= \
    sa-src-address= src-address=