Allied Telesis AT-WR4500 manual

190	AT-WR4500 Series - IEEE 802.11abgh Outdoor Wireless Routers
	RouterOS v3 Configuration and User Guide

large packets with don't fragment flag will not be able to pass the router inherit - do not change the field

set - set the field, so that each packet matching the rule will not be fragmented. Not recommended dst-address(IP address/netmask:port; default: 0.0.0.0/32:any) - destination IP address dynamic (read-only: flag) - whether the rule has been created dynamically

in-accepted(integer) - how many incoming packets were passed through by the policy without an attempt to decrypt

in-dropped(integer) - how many incoming packets were dropped by the policy without an attempt to decrypt

in-transformed(integer) - how many incoming packets were decrypted (ESP) and/or verified (AH) by the policy

inactive (read-only: flag) - whether the rule is inactive (it may become inactive due to some misconfiguration)

ipsec-protocols(multiple choice: ah esp; default: esp) - specifies what combination of Authentication Header and Encapsulating Security Payload protocols you want to apply to matched traffic. AH is applied after ESP, and in case of tunnel mode ESP will be applied in tunnel mode and AH - in transport mode level (unique require use; default: require) - specifies what to do if some of the SAs for this policy cannot be found:

use - skip this transform, do not drop packet and do not acquire SA from IKE daemon require - drop packet and acquire SA

unique - drop packet and acquire a unique SA that is only used with this particular policy manual-sa(name; default: none) - name of manual-sa template that will be used to create SAs for this policy

none - no manual keys are set

out-accepted(integer) - how many outgoing packets were passed through by the policy without an attempt to encrypt

out-dropped(integer) - how many outgoing packets were dropped by the policy without an attempt to encrypt

out-transformed(integer) - how many outgoing packets were encrypted (ESP) and/or signed (AH) ph2-state(read-only: expired no-phase2 established) - indication of the progress of key establishing expired - there are some leftovers from previous phase2. In general it is similar to no-phase2no-phase2- no keys are estabilished at the moment

estabilished - Appropriate SAs are in place and everything should be working fine

priority (integer; default: 0) - policy ordering classificator (signed integer). Larger number means higher priority

proposal (name; default: default) - name of proposal information that will be sent by IKE daemon to establish SAs for this policy

protocol (name integer; default: all) - IP packet protocol to match

sa-dst-address(IP address; default: 0.0.0.0) - SA destination IP address (remote peer)

sa-src-address(IP address; default: 0.0.0.0) - SA source IP address (local peer)

src-address(IP address/netmask:port; default: 0.0.0.0/32:any) - source IP address

tunnel (yes no; default: no) - specifies whether to use tunnel mode

￿

All packets are IPIP encapsulated in tunnel mode, and their new IP header src-address and dst- address are set to sa-src-address and sa-dst-address values of this policy. If you do not use tunnel mode (id est you use transport mode), then only packets whose source and destination addresses are the same as sa-src-address and sa-dst-address can be processed by this policy. Transport mode can only work with packets that originate at and are destined for IPsec peers (hosts that established security associations). To encrypt traffic between networks (or a network and a host) you have to use tunnel mode.

It is good to have dont-fragment cleared because encrypted packets are always bigger than original and thus they may need fragmentation.

If you are using IKE to establish SAs automatically, then policies on both routers must exactly match each other, id est src-address=1.2.3.0/27 on one router and dst-address=1.2.3.0/28 on another would not work. Source address values on one router MUST be equal to destination address values on the other one, and vice versa.