L2TP cannot connect across US border on AT&T network

[sindy]

• The final step is to add the /32 named interface to the OSPF configuration including setting the cost parameter value like this

cost=<as described>  interface=<interface name> network-type=point-to-point

This shows how a precise wording is important for understanding

I’ve also learned something new, my colleagues kept telling me that Mikrotik was bad for not supporting /31 networks as OSPF “didn’t work on that ‘emulation’ of /31 subnets using one /32 as the address and another /32 as the network”. Based on your description, I will have to revisit the topic with them.

Reading through your comments, I’m getting a little worried. I have always assumed that our transport configuration of IPSec encrypted the payload of the tunnel. That’s something I need to revisit.

The only cheer up I can give you is that there is at least the MPPE for the non-OSPF traffic.

This cannot be resolved by using “wider” policies for the IKEv2 sessions, but you can enable the “automatic” IPsec encryption of the L2TP control&transport packets for all links, not just the AT&T ones. Or, if you don’t like IKE(v1) and/or the pre-shared key authentication, you can use IKEv2 with some more advanced authentication setup to encrypt the L2TP C&T packets instead, but you’d have to configure it manually.

I would very much like to talk to you. Currently, I’m in California, but I can easily do a call late at night to reach a European destination. DM how to reach you?

It seems the need to talk became less urgent as the misunderstandings have been clarified by now, but still no problem. Since DM is long disabled here, use this. Your 9-12 AM maps to my 6-9 PM so not a big deal; if you are an owl, your 11PM-1AM is my 8-10 AM, also not a big deal.