L2TP/IPSEC Connectivity Issue

Good afternoon,

Newest problem is as follows if you can point me out to what is causing this issue.

I have an L2TP with IPSEC server running on a MikroTiK RB4011.
I can connect from an android device using LTE to the L2TP without any problems BUT if the device switches to WIFI and tries to connect it fails miserably.
I read somewhere that i have to change the generate policy from port strict to port override but it creates dynamic rules which i can’t change and i can’t seem to figure out
how to add it manually and point it to the L2TP server on 6.46.x version.

On the RB4011 there is also a working IPSEC site to site tunnel.
/ppp profile
add bridge=bridge1 dns-server=8.8.8.8 local-address=192.168.0.254 name=
l2tp_ipsec remote-address=vpnpool use-encryption=required
/ppp secret
add name=admin password=xxxxxxxx profile=l2tp_ipsec service=l2tp
/interface l2tp-server server
set allow-fast-path=yes authentication=mschap1,mschap2 default-profile=
l2tp_ipsec enabled=yes ipsec-secret=xxxxxxx keepalive-timeout=disabled
max-mru=1460 max-mtu=1460 use-ipsec=yes
/ip firewall filter
add action=accept chain=input dst-port=500,1701,4500 protocol=udp
add action=accept chain=input comment="IPSec enable " protocol=ipsec-esp

Thanks in advance

i can’t seem to figure out how to add it manually and point it to the L2TP server on 6.46.x version.

You will have to create an IPsec in transport Mode, not tunnel mode, manually and then create your L2TP Tunnel over the IPsec and then add the appropriate routes…
This way you actually do what the L2TP/IPsec would do automatically…

BUT if the device switches to WIFI and tries to connect it fails miserably.

Within the same LAN where the IPsec server is ?

Is the Android phone connected to the WiFi provided by the very same 4011 which is the L2TP/IPsec server, or is it provided by the same Mikrotik which itself is a peer of the site-to-site IPsec tunnel, or is it totally unrelated to either of them?

Is the site-to-site tunnel an IKE(v1) or IKEv2 one?


I don’t think port override would change anything. You can create the IPsec settings for an L2TP server, ideally by letting the /ip l2tp-server server create the peer and identity, and then copying them with the same parameters:
ip ipsec peer add copy-from=l2tp-in-server name=l2tp-in-static
ip ipsec identity add copy-from=[find comment~“l2tp”] peer=l2tp-in-static

The static peer will be shadowed by the dynamically added one until you disable the auto-creation in /interface l2tp-server server.
Then, you can completely customize the settings - use a different profile for the peer, choose a different policy-generation method and policy-generation template group in identity, so you can use a different policy template with a different proposal. But I bet none of these will resolve the issue, as the Android phone itself has no reason to change the behavior of the VPN client depending on the network interface it uses.

Different location

Different location, the site to site is IKEv2

Does the log say anything when you try to connect through WiFi? Any errors ?

the packet is retransmitted about 5 times then phase1 negotiation failed

i tried creating it manually but i must be doing something wrong i dial in and it says established but the phone still tries to connect (shows connecting instead of connected) then fails.
I obviously must be doing it wrong i have to try and find out how to make it in transport mode.

/ip ipsec peer
add name=l2tpserver passive=yes
/ip ipsec profile
set [ find default=yes ] dh-group=modp1024 enc-algorithm=aes-128
add dh-group=modp1024 dpd-interval=1m dpd-maximum-failures=3 enc-algorithm=
aes-128 name=profile1
/ip ipsec peer
add address=xx.xx.xx.xx/32 comment=vpn01 exchange-mode=ike2 name=peer1 profile=
profile1
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc lifetime=0s
add enc-algorithms=aes-128-cbc lifetime=1d name=secure-proposal
/ip ipsec identity
add generate-policy=port-override peer=peer1 secret=xxxxxxxxxx
add generate-policy=port-override peer=l2tpserver remote-id=ignore secret=
xxxxxxxxxx
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
add dst-address=192.168.5.0/24 peer=peer1 proposal=secure-proposal
sa-dst-address=xx.xx.xx.xx sa-src-address=192.168.1.235 src-address=
192.168.0.0/24 tunnel=yes

the policy is created on its own i see dynamically the l2tp one and gets deleted when it fails.

Also when i attemp all these i switch OFF the L2TP server is that correct?

Which “the” packet? The first response one from the Mikrotik to the phone or one of the later ones?

I’ve seen multiple cases recently which behaved similarly - the initial negotiation failed at some stage. In one case it boiled down to packets being too large and fragmented, in the other one I’ve got no feedback yet, these were both related to certificate-based authentication. Another case was also L2TP/IPsec, and it seemed to have to do with Android version, but no one has ever stated anything regarding WiFi or mobile connection of the mobile.


What’s the point?

the packet is retransmitted about 5 times then phase1 negotiation failed

Please check in the firewall and make sure UDP 4500 is accepted in the input chain…

ALso, from a quick look at yout config, tunnel=no, not yes… Otherwise Tunnel Mode is used and not Transport mode…

That’s a config for the site-to-site tunnel, that’s fine.

I am trying to get my head around the concept…

So static IPSEC entries mean /ppp l2tp-server enabled but without the use of ipsec in that menu?

I have port 500,1701,4500 in the input chain accepted and at the top of the firewall list.

The tunnel is from the site to site connection

21:34:18 ipsec,info respond new phase 1 (Identity Protection): 192.168.1.235[500]<=>xxxxxxxxxxx[500]
21:34:21 ipsec,info the packet is retransmitted by xxxxxxxxxxxxx[500].
21:34:24 ipsec,info the packet is retransmitted by xxxxxxxxxxxxx[500].
21:34:27 ipsec,info the packet is retransmitted by xxxxxxxxxxxxx[500].
21:34:30 ipsec,info the packet is retransmitted by xxxxxxxxxxxxx[500].
21:34:33 ipsec,info the packet is retransmitted by xxxxxxxxxxxxx[500].
21:34:48 l2tp,info first L2TP UDP packet received from xxxxxxxxxxxxxx
21:35:18 ipsec,error phase1 negotiation failed due to time up 192.168.1.235[500]<=>xxxxxxxxxxx[500]

where x public ip that tries to come in the 4011

Correct. Setting use-ipsec to no in /ip l2tp-server server will not prevent actual use of IPsec but it will just prevent the dynamic IPsec configuration from being created. The dynamically created one uses the default peer profile, default proposal, and creates the identity with generate-policy set to port-strict. Creating these two items manually allows you to customize them, to test whether the generate-policy=port-override will resolve the issue.

If this change doesn’t help as I assume, I’d recommend you set /tool sniffer set file-name=android_startup.pcap, run /tool sniffer ip-address=the.public.ip.of.the.WiFi.where.the.phone.is.connected while you run the log (/log print follow-only file=android_startup where topics~“ipsec”) and do a connection attempt from the phone.

This will show you whether the packets towards the phone actually leave the Mikrotik and if yes, which route they take. The dump on the screen will show the physical interfaces; the pcap file will allow to analyse the packets in Wireshark.

wireshark analysis

1 0.000000 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
2 0.000490 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)
3 2.994769 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
4 2.994863 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)
5 6.015313 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
6 6.015413 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)
7 9.088846 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
8 9.088926 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)
9 9.999948 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)
10 12.040644 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
11 12.040727 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)
12 15.027681 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
13 15.027780 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)
14 18.039470 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
15 20.001693 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)
16 21.041981 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
17 24.077041 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
18 27.060918 xx.xx.xx.xx 192.168.1.235 ISAKMP 766 Identity Protection (Main Mode)
19 30.004169 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)
20 30.142942 xx.xx.xx.xx 192.168.1.235 L2TP 111 Control Message - SCCRQ (tunnel id=0, session id=0)
21 30.143211 192.168.1.235 xx.xx.xx.xx L2TP 142 Control Message - SCCRP (tunnel id=8701, session id=0)
22 30.143892 xx.xx.xx.xx 192.168.1.235 L2TP 78 Control Message - StopCCN (tunnel id=0, session id=0)
23 30.144008 192.168.1.235 xx.xx.xx.xx L2TP 54 Control Message - ZLB (tunnel id=8701, session id=0)
24 30.230285 xx.xx.xx.xx 192.168.1.235 ICMP 170 Destination unreachable (Port unreachable)
25 30.230348 xx.xx.xx.xx 192.168.1.235 ICMP 82 Destination unreachable (Port unreachable)
26 40.000199 192.168.1.235 xx.xx.xx.xx ISAKMP 190 Identity Protection (Main Mode)

OK, so you can see three things from there:

  • the Mikrotik sends the responses back to the mobile but they apparently never reach it, as it keeps re-sending the first packet, so the next question is whether they are leaving through the right interface (which is what the first column of the command line output of /tool sniffer quick should show you)
  • the size of the response packet is so small that the “lost fragments of a huge packets” theory is obviously not applicable
  • the L2TP connection was about to set up without being protected by IPsec. To prevent this from happening, you have to add a rule chain=input action=drop protocol=udp dst-port=1701 ipsec-policy=in,none before the chain=input action=accept connection-state=established,related one, because you want the L2TP to break also if the IPsec eventually stops working mid-session.

By any chance, can you sniff at the AP to which the Android phone is connected?

No unfortunatelly…the other side has no Tik’s or anything. Just an ISP router where the android phone connects to it via the onboard WiFi.

Hm. What’s the Android version? My 8.1.0 “Just Works” via both 4G and WiFi… the L2TP/IPsec server is 6.44.6.

The ISP blackbox may have its own IPsec handling which interferes with IPsec connections from LAN…

Asked my neighbour to access his WiFi abit and the same thing happens to me also…i can connect via my 4G and not via WiFi so this happens at 2 different locations. Both Androids have 9.0.
Ipsec Server 6.46.5.

I am having my suspicions that there could be elevated firewall policies that have to be disabled from the ISP side as far as the HQ is concerned…

That might be it… do you want me to give a try from my 8.1.0? If so, I can send you my public key and instruction how to use it to send me the contact information via a forum post securely. The test account may get an address blocked by firewall so it wouldn’t get anywhere.

Also, think about installing Strongswan on the phone(s) and using IKEv2.


Selective policies depending on the remote IP, and blocking the direction from the client (the HQ) to internet after letting the packet from the internet to the client through? That would be a really exotic approach…

As your own phone suffers from that problem too, maybe you could connect it to your home AP and place that AP behind the home Mikrotik, so that you could sniff on it to see whether the packets get dropped on the path between the HQ and the client’s WiFi AP or whether they make it (almost) to the phone?