IPsec IKEv2 Fundamentals

Understand the basics of IKEv2 and IPsec policies on RouterOS 7.

IPsec IKEv2 Fundamentals

While WireGuard is praised for its simplicity, IPsec remains the enterprise standard for site-to-site connectivity due to its extensive interoperability with diverse vendor equipment. However, this flexibility comes at the cost of complexity.

Phase 1 (IKEv2) vs Phase 2 (IPsec Policies)

Phase 1 (IKEv2): The control plane. It establishes a secure, authenticated communication channel between the two peers. It handles authentication (e.g., pre-shared keys, certificates) and negotiates the encryption parameters for the control channel itself.
Phase 2 (IPsec Policies): The data plane. Once Phase 1 is established, it negotiates the Security Associations (SAs) for the actual user data traffic. This defines exactly what traffic gets encrypted (e.g., Subnet A to Subnet B) and how it gets encrypted (ESP, encryption algorithms).

RouterOS 7 Basic Configuration

Configuring IKEv2 requires setting up profiles, proposals, peers, identities, and policies.

1. Profile and Proposal

/ip ipsec profile
add name=ikev2-profile hash-algorithm=sha256 enc-algorithm=aes-256 dh-group=modp2048

/ip ipsec proposal
add name=ikev2-proposal auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=modp2048

Go to IP → IPsec → Profiles tab. Click [+]. Name: ikev2-profile. Hash: sha256, Encryption: aes-256, DH Group: modp2048. Click OK.
Go to Proposals tab. Click [+]. Name: ikev2-proposal. Auth Algorithms: sha256, Encr. Algorithms: aes-256-cbc, PFS Group: modp2048. Click OK.

2. Peer and Identity (Phase 1)

/ip ipsec peer
add address=203.0.113.10/32 exchange-mode=ike2 name=peer1 profile=ikev2-profile

/ip ipsec identity
add peer=peer1 auth-method=pre-shared-key secret="SuperSecretKey123!"

Go to Peers tab. Click [+]. Name: peer1, Address: 203.0.113.10, Profile: ikev2-profile, Exchange Mode: IKE2. Click OK.
Go to Identities tab. Click [+]. Peer: peer1, Auth. Method: pre shared key, Secret: SuperSecretKey123!. Click OK.