I have 3 sites A, B and C each with a Mikrotik Router
I have working IPSec VPNs between A => B and B => C
Is it possible to send traffic from A to C without creating a new tunnel directly between them eg route thought B?
Yep, it is possible. Even with pure policy-based IPec setup. Just extend your IPsec policies. Send here your current IPsec config if you'd like someone to try to assist you with the configuration.Is it possible to send traffic from A to C without creating a new tunnel directly between them eg route thought B?
#Router A /ip ipsec peer add address=B.B.B.B/32 dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha1 lifetime=8h secret=????? /ip ipsec policy #A->B add dst-address=172.16.0.0/16 level=unique proposal=default sa-dst-address=B.B.B.B sa-src-address=A.A.A.A src-address=10.120.5.0/24 tunnel=yes #A->B->C?? add dst-address=10.5.3.0/24 level=unique proposal=default sa-dst-address=B.B.B.B sa-src-address=A.A.A.A src-address=10.120.5.0/24 tunnel=yes
#Router B /ip ipsec peer add address=A.A.A.A/32 dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha1 lifetime=8h secret=????? add address=C.C.C.C/32 dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha1 lifetime=8h secret=????? /ip ipsec policy #B->A add dst-address=10.120.5.0/24 level=unique proposal=default sa-dst-address=A.A.A.A sa-src-address=B.B.B.B src-address=172.16.0.0/16 tunnel=yes #B->C add dst-address=10.5.3.0/24 level=unique proposal=default sa-dst-address=C.C.C.C sa-src-address=B.B.B.B src-address=172.16.0.0/16 tunnel=yes
#Router C /ip ipsec peer add address=B.B.B.B/32 dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha1 lifetime=8h secret=????? /ip ipsec policy #C->B add dst-address=172.16.0.0/16 level=unique proposal=default sa-dst-address=B.B.B.B sa-src-address=C.C.C.C src-address=10.5.3.0/24 tunnel=yes #C->B->A?? add dst-address=10.120.5.0/24 level=unique proposal=default sa-dst-address=B.B.B.B sa-src-address=C.C.C.C src-address=10.5.3.0/24 tunnel=yes
The rules you've added to A and C seem to be correct. On B you need to add the following:This is what I have so far... not really sure what I need to add to B??
add dst-address=10.120.5.0/24 level=unique proposal=default sa-dst-address=A.A.A.A sa-src-address=B.B.B.B src-address=10.5.3.0/24 tunnel=yes add dst-address=10.5.3.0/24 level=unique proposal=default sa-dst-address=C.C.C.C sa-src-address=B.B.B.B src-address=10.120.5.0/24 tunnel=yes