Ipsec有多少人做成功呢？按照网大和论坛的做法都是无法做成功

kyer2012

设置都是一摸一样的，为什么就是不同呢？

难道是版本之间的问题

难道是内网多网段的问题


192.168.10.0/24 ->>ros_a ->>113.65.137.** ->>internet ->>113.119.222.**->ROS_b ->192.168.100.0/24 ->>ros_a:

2 主机ROS-A：
/ip ipsec proposal
set default auth-algorithms=md5 disabled=no enc-algorithms=3des lifetime=30m name=default pfs-group=modp1024
/ip ipsec peer
add address=113.119.222.**/32:500 auth-method=pre-shared-key dh-group=modp1024 disabled=no dpd-interval=\
    disable-dpd dpd-maximum-failures=1 enc-algorithm=3des exchange-mode=main generate-policy=yes \
    hash-algorithm=md5 lifebytes=0 lifetime=1d my-id-user-fqdn="" nat-traversal=yes proposal-check=obey \
    secret=123 send-initial-contact=yes
/ip ipsec policy
add action=encrypt disabled=no dst-address=192.168.100.0/24:any ipsec-protocols=esp level=require priority=\
    0 proposal=default protocol=all sa-dst-address=113.119.222.** sa-src-address=113.65.137.** src-address=\
    192.168.10.0/24:any tunnel=yes
/ip firewall nat
add action=accept chain=srcnat comment="" disabled=no dst-address=192.168.100.0/24 \
    src-address=192.168.10.0/24

2 主机ROS-B：
/ip ipsec proposal
set default auth-algorithms=md5 comment="" disabled=no enc-algorithms=3des lifetime=30m name=default pfs-group=modp1024
/ip ipsec peer
add address=113.65.137.**/32:500 auth-method=pre-shared-key comment="" dh-group=modp1024 disabled=no \
    dpd-interval=disable-dpd dpd-maximum-failures=1 enc-algorithm=3des exchange-mode=main generate-policy=yes \
    hash-algorithm=md5 lifebytes=0 lifetime=1d nat-traversal=yes proposal-check=obey secret=123 \
    send-initial-contact=yes
/ip ipsec policy
add action=encrypt comment="" disabled=no dst-address=192.168.10.0/24:any ipsec-protocols=esp level=require \
    priority=0 proposal=default protocol=all sa-dst-address=113.65.137.** sa-src-address=113.119.222.** \
    src-address=192.168.100.0/24:any tunnel=yes
/ip firewall nat
add action=accept chain=srcnat comment="" disabled=no dst-address=\
    192.168.10.0/24 src-address=192.168.100.0/24

kyer2012

  没人鸟下！

arainbow

我成功了！！不过还是不明白很多东西。很多类型也没尝试。

okokop

时间同步是关键
Ipsec 的自动更新密钥
应该是以时间为基数
算出来的

naboo

site to site的早就成功过!

现在闹心的是l2tp+ipsec+NAT从不成功....

naboo

http://bbs.routerclub.com/thread-26893-1-1.html

看看我以前的帖子吧, 注意区分nat流