Site to Site IPsec tunnel, MikroTik <--> AWS

Consider setup as illustrated below. Office router "MikroTik RouterOS" and Amazon Web Services "AWS" are connected to internet and office workstations are behind NAT.

The Office has its own local subnet, 192.168.0.0/24.

Amazon has its own local subnet, 172.16.0.0/16

Both remote office and AWS needs secure tunnel to local networks behind routers.

VPN Connection Configuration

• AWS utilizes unique identifiers to manipulate the configuration a VPN Connection. Each VPN Connection is assigned an identifier and is associated with two other identifiers, namely the
• Customer Gateway Identifier and Virtual Private Gateway Identifier.
• Your VPN Connection ID : vpn-xxxxxxxx
• Your Virtual Private Gateway ID : vgw-yyyyyyyy
• Your Customer Gateway ID : cgw-zzzzzzzz
  • This configuration consists of two tunnels. Both tunnels must be configured on your Customer Gateway, but only one of those tunnels should be up at any given time.

Note that Mikrotik RouterOs does not support Active/Active or Active/Standby setup with AWS hosted VPN solution.

At this time this configuration has only been tested for RouterOS 6.36, but may work with other versions.

This configuration uses the Winbox utility to configure the IPsec VPN connection. Winbox is a small utility that allows administration of

Mikrotik RouterOS using a fast and simple GUI.
You can download this utility from: https://mikrotik.com/download

! IPSec Tunnel #1
 

#1: IPSec Proposal Configuration

An IPsec proposal defines the IPsec parameters for encryption, authentication, Diffie-Hellman, and lifetime.
Please note, these sample configurations are for the minimum requirement of AES128, SHA1, and DH Group 2.
You will need to modify these sample configuration files to take advantage of AES256, SHA256, or other DH
groups like 2, 14-18, 22, 23, and 24.
Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".

Go to IP Tab --> IPsec --> Proposals

a. Click on "+" button

#ANY NAME"
b. Name: ipsec-vpn-xxxxxxxx-x
c. Auth. Algorithms: sha1
d. Encr. Algorithms: aes-128-cbc
e. Lifetime: 01:00:00
f. PFS Group: modp1024
g. Select Apply and Ok

Internet Key Exchange

A policy is established for the supported ISAKMP encryption, authentication, Diffie-Hellman, lifetime, and key parameters. The IKE peer is configured with the supported IKE encryption, authentication, Diffie-Hellman, lifetime, and key parameters.Please note, these sample configurations are for the minimum requirement of AES128, SHA1, and DH Group 2.

You will need to modify these sample configuration files to take advantage of AES256, SHA256, or other DH groups like 2, 14-18, 22, 23, and 24.

Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".
The address of the external interface for your customer gateway must be a static address.
Your customer gateway may reside behind a device performing network address translation (NAT). To ensure that NAT traversal (NAT-T) can function, you must use the corresponding IP as the "Local Address".

Create an IKE policy permitting traffic from your local subnet to the VPC subnet. Go to IP Tab --> IPsec --> Policies

1) Click on "+" button and select the General Tab
a. Src. Address: local subnet/mask
b. Dst. Address: AWS VPC subnet/mask

2) Click on Action Tab
a. Select Tunnel
b. SA Src. Address: xxx.xxx.xxx.xxx "MikroTik Public IP Address"
c. SA Dst. Address: yyy.yyy.yyy.yyy " AWS Public IP Address"

#"ANY NAME"
d. Proposal: ipsec-vpn-xxxxxxxx-x
e. Select Apply and Ok

There are two policies configured in IPsec Policy, one for a /30 private IP Address provided by AWS and one for MikroTik local IP Address/AWS local IP Address