Hap AX Lite crashes with IPSec

RouterOS General
1

Hello

7.21.5 Hap AX Lite configured using L2TP to a remote PPP server (RB5009)

if I use IPSEC (128CTR the router crashes with kernel error. 128SBC is very slow.

the only way to use L2TP is cleartext or MPPE128.

PH1: sha1/aes128 ECP256

PH2: sha1/sha256 AES128CTR - PFS: ECP256

The conf is very plain:

eth1: WAN (dhcp client)

eth2-3 (bridge) in LAN 192.168.0.x/24

simple NAT+fasttrack

no particular options or configuration activated. We have found this issue on 7.20.8 and newer. We are unable to use IPSEC on the L2TP.

anyone else has a suggestion?

2

Submit this directly on the support portal or support@mikrotik.com

This is usually a problem with the hw offload driver. Since it's a new device, this is not unlikely.

Also, verify the error on the latest stable.

3

hap ax lite is around for several years actually.

4

What you describe does not sound like a configuration error. If enabling ESP with AES-128-CTR consistently produces a kernel crash, while changing only the ESP cipher to AES-128-CBC (I assume "SBC" means CBC) makes it work—albeit slowly—that strongly suggests a RouterOS bug or a hardware/driver issue rather than an IKE proposal mismatch.

Although FastTrack should bypass IPsec correctly, there have been IPsec/FastPath/FastTrack regressions in various RouterOS releases. Test with FastTrack completely disabled.

Disable hardware crypto (if applicable)

The hAP ax lite (L009) uses an ARM platform where crypto acceleration and driver interaction have changed across RouterOS releases. There have been IPsec stability fixes for specific hardware in recent releases.

Try AES-GCM, Instead of: AES-128-CTR + SHA256 try : AES-128-GCM

which avoids a separate authentication algorithm and exercises different code paths. Remove PFS temporarily Test: PFS = none

It would be nice if you could at least see the firewall configuration... Open Terminal and write- /IP/firewall/export

5

I have already submitted the ticket. I have also tried with the latest stable with no difference :frowning:

6

AI response ?
AX Lite is NOT L009. Totally different things.
I have both. I don't need spec sheet to see the difference.

As for age of AX Lite, the later AX Lite LTE is in the mean time already EOL'd ?
Couldn't find back references though ...

7

there is a very plain simple config, accept established/related and fasttrack for the nat users. I didnt try GCM since it is a small device and GCM is not hw offloaded. At the moment I solved using MPPE128 (since it is MT with MT). Really I dont need security there but since it is hw-offloaded, I choosed IPSEC.

8

Q: why not wireguard ? Might even be faster ?

9

For a consistency reason, it is easier and faster to implement L2TP than wireguard in our specific enveroniment.

10

What is the last version that worked?

11

it never worked on hap ax lite!

12

I'd call that pretty consistent.

13

When testing vpn performance between AX Lite and RB5009, wireguard was for me faster then IPSEC. A lot faster.
But IPSEC never crashed. Maybe because I really set it minimum minimum. Too long ago to recall what I used then.

14

Not that it's okay that it crashes, but I can't help wondering: why CTR?

15

Because CBC is not so fast and on this platform is really slow (about 20mbit/sec), GCM is not hw/offloaded on this platform, the CTR is the way to go to be hw/offloaded

16

Sorry, I mixed up the models because I have a lot of them available. From experience I can say that IPsec crashes have only happened when the problem was hardware. If there is a wrong configuration, then IPsec simply does not work. Of course you can also test what is happening on the ISP provider's side, whether the network is really stable. I remember there was a case where the VPN tunnel between two offices was broken twice a week. In the end, it turned out to be a damaged cable, which looked completely fine.

17

Firstly, since you have the opportunity to use MicroTik on both sides, then you should use chacha20poly1305 on AX Lite, it provides about 80 Mbps, which is very comfortable.

please note that support chacha20poly1305 in ~7.20 could only work for IKEv2, it seems to me that it was added later for regular ipsec main

secondly, I use the AX Lite LTE6 with the following configuration:

/ip ipsec peer
add address=1.2.3.4/32 exchange-mode=ike2 name=peer1
/ip ipsec proposal
add enc-algorithms=chacha20poly1305,aes-256-cbc,aes-192-cbc,aes-128-cbc name=proposal1
/ip ipsec identity
add my-id=address:10.0.0.2 peer=peer1 secret=12345678
/ip ipsec policy
add dst-address=10.0.0.0/24 level=unique peer=peer1 proposal=proposal1 src-address=10.0.0.2/32 tunnel=yes

it worked for more than 100 days without problems on routeros 7.19.6, after which I upgraded it to 7.20.8 and am now monitoring, and I don't see any problems either.

18

Hello. Thank you for your input

the chachapoly dont work on l2tp, the connection fail to process PH2. I use L2TP (not IKEv2). At the moment the only solution I found is to use cleartex or MPPE128 (software).

I wil try in the next few days to test other encr algoritm to see wich speed I can achieve.

19

UPDATE:

Really... I have received the first answer from mikrotik.... the cause is the SPECTRAL SCAN !!!!!

Absolute nonsense.

The router crashes in boot loop crash just when I enable the checkbox "use IPSEC" in the ppp client! and never recovers till I disconnect the WAN side (so can't establish the IPSEC L2TP)....

I replied to the email and I wait for further comments.

20

the reason for ipsec crash is wifi spectral scan?