MikroTik BOVPN Integration Guide

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product.

This integration guide describes how to configure a Branch Office VPN (BOVPN) tunnel between a WatchGuard Firebox and a MikroTik device.

Contents

• MikroTik BOVPN Integration Guide
  • Contents
  • Integration Summary
  • Test Topology
  • Configure the Firebox
    • Configure Branch Office VPN Gateway General Settings
    • Configure the Branch Office VPN Gateway Phase 1 settings
    • Configure the Branch Office VPN Tunnels
  • Configure the MikroTik Device
    • Configure NAT
      • Create Another NAT for Multiple BOVPN Tunnels
    • Configure IPSec Settings
      • Create a New Policy to Support Multiple BOVPN Tunnels
  • Test the Integration

Test Topology

This diagram shows the topology used to connect your WatchGuard Firebox and a MikroTik device through a VPN.

Configure the Firebox

This section describes how to configure the Firebox and BOVPN settings.

Configure Branch Office VPN Gateway General Settings

To configure BOVPN gateway general settings, from Fireware Web UI:

1. Select VPN > Branch Office VPN.
   The Branch Office VPN configuration page opens.
2. To add a gateway, in the Gateways section, click Add.
   The Gateway Endpoint Settings dialog box opens.
3. In the Gateway Name text box, type the Gateway name.
4. In the Address Family drop-down list, select IPv4 Address.
5. In the Credential Method section, select Use Pre-Shared Key and String-Based.
6. In the adjacent text box, type the pre-shared key.

7. In the Gateway Endpoint section, click Add.
   The Gateway Endpoint Settings dialog box opens.
8. From the External Interface drop-down list, select External.
9. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
   The Primary Interface IP Address is the primary IP address that you configure on the external interface that you select.
   
10. Select By IP Address.
11. In the adjacent text box, type the primary IP address of the External Firebox interface.
    

12. Select the Remote Gateway tab.
13. Select Static IP Address.
14. In the adjacent text box, type the public IP address of your MikroTik connection.
15. Select By IP Address.
16. In the adjacent text box, type the public IP address of your MikroTik connection.
17. Keep the default settings for all other options.

18. Click OK.

Configure the Branch Office VPN Gateway Phase 1 settings

To configure Phase 1 settings, from Fireware Web UI:

1. Select the Phase 1 Settings tab.
   
2. From the Version drop-down list, select IKEv2.
3. For all other settings, keep the default values.

4. Click Save.

Configure the Branch Office VPN Tunnels

To configure BOVPN tunnels, from Fireware Web UI:

1. On the Branch Office VPN page, in the Tunnels section, click Add.
   The Branch Office VPN Tunnel configuration interface opens.
2. From the Gateway drop-down list, select the gateway that you added.

3. In the Addresses section, click Add to configure tunnel routes for the tunnel.
   The Tunnel Route Settings dialog box opens.
4. In the Local IP section, from the Choose Type drop-down list, select Network IPv4.
5. In the Network IP text box, type the Network IP address, which is the internal network IP address of the WatchGuard Firebox.
6. In the Remote IP section, from the Choose Type drop-down list, select Network IPv4.
7. In the Network IP text box, type the Network IP address, which is the internal network IP address of the MikroTik device.
8. For all other settings, keep the default values.

9. Click OK.

10. Click Save.

11. Repeat Steps 1-10 to create another tunnel if you need multiple BOVPN tunnels.

For more information about Branch Office VPN configuration on the Firebox, go to Configure Manual BOVPN Gateways and Configure Manual BOVPN Tunnels

Configure the MikroTik Device

To configure the MikroTik device:

1. Log on to the MikroTik Web UI. The default IP address and port are http://192.168.88.1 and ether2.
2. Configure all required MikroTik interfaces.
3. Verify that the MikroTik device can connect to the Internet.

Configure NAT

To configure NAT settings, from the MikroTik Web UI:

1. Select IP > Firewall > NAT.
2. Click Add New.
3. From the Chain drop-down list, select srcnat.
4. In the Src. Address text box, type the Network IP address, which is the internal network IP address of the MikroTik device.
5. In the Dst. Address text box, type the Network IP address, which is the internal network IP address of the Firebox.
6. From the Out. Interface drop-down list, select ether1.
7. From the Action drop-down list, select Accept.
8. Keep the default settings for all other options.

9. Click Apply, and click OK.

Create Another NAT for Multiple BOVPN Tunnels

If you need multiple BOVPN tunnels, you can create another NAT:

1. From the MikroTik user interface, create another NAT.

2. Click Apply, and click OK.

Configure IPSec Settings

To configure IPSec settings on the MikroTik device:

1. Select IP > IPsec > Proposals.
2. Modify the default proposal.
   
3. In the Name text box, type the proposal name or keep the default name.
4. In the Auth. Algorithms section, select sha256.
5. In the Encr. Algorithms section, select aes-256 cbc.
6. From the PFS Group drop-down list, select modp2048.
7. Keep the default settings for all other options.

8. Click Apply, and click OK.

9. Select the Peers tab.
10. To add new peer, click Add New .
    
11. In the Name text box, type the peer name.
12. In the Address text box, type the IP address of the External interface of the Firebox.
13. In the Local Address text box, type the IP address of the ether1 interface of the MikroTik.
14. From the Exchange Mode drop-down list, select IKE2.
15. Keep the default settings for all other options.

16. Click Apply, and click OK.

17. Select the Identities tab.
18. To add a new Identity, click Add New .
19. From the Peer drop-down list, select peer1.
20. From the Auth. Method drop-down list, select pre shared key.
21. In the Secret text box, type the secret. The secret must be the same as the pre-shared key specified in the Firebox settings.
22. Keep the default settings for all other options.

23. Click Apply, and click OK.

24. Select the Profiles tab.
25. Modify the default profile.
    
26. From the Hash Algorithms drop-down list, select sha256.
27. In the Encryption Algorithm section, select aes-256.
28. In the DH Group section, select modp2048.
29. Keep the default settings for all other options.

30. Click Apply, and click OK.

31. Select the Policies tab.
32. To add a new policy, click Add New.
33. From the Peer drop-down list, select peer1.
34. Select Tunnel.
35. In the Src. Address text box, type the Network IP address, which is the internal network IP address of the MikroTik device.
36. In the Dst. Address text box, type the Network IP address, which is the internal network IP address of the WatchGuard Firebox.
37. Keep the default settings for all other options.

38. Click Apply, and click OK.

Create a New Policy to Support Multiple BOVPN Tunnels

To create a new policy, from the MikroTik Web UI:

1. Open an existing policy.
2. In the Action section, from the Level drop-down list, select unique.

3. Click Apply, and click OK.
4. You can now create a policy for a second tunnel.

5. Click Apply, and click OK.

Test the Integration

To test the integration, from Fireware Web UI:

1. Select System Status > VPN Statistics.
2. Select the Branch Office VPN tab.
3. Verify that the VPN is established.

4. From the MikroTik Web UI, select IP > IPsec > Policies.
5. Select the Policies tab and verify the results.
   

6. Verify that hosts can ping each other successfully.