Have you configured IPsec tunnels on MikroTik? Are you familiar with IPsec phases, DH groups?

Yes, I have configured IPsec tunnels on MikroTik. I am familiar with the two main phases of IPsec:

• Phase 1 (IKE Phase 1) — establishes a secure channel (ISAKMP SA) for exchanging keys and encryption parameters.
• Phase 2 (IKE Phase 2) — creates an IPsec SA for encrypting and authenticating user data.

I am also familiar with Diffie-Hellman (DH) groups, which define parameters for key exchange in phase 1. For example, DH Group 2 (1024 bits), Group 14 (2048 bits), and stronger groups for enhanced security.

In MikroTik, configuration includes selecting protocols (ESP, AH), encryption algorithms (AES, 3DES), authentication methods (SHA, MD5), and specifying the DH group for IKE.