l2TP/ipsec from win10 behind mikrotik to natted mikrotik [Solved]

RouterOS General
1

Scenario:

[Win10_l2tp/ipsec]--------crs125----------------(internet)----------------isp_router_full_natted_to_RB----------rb3011


From iPhone to rb3011 the l2tp/ipsec works immediately

From Win10 behind crs125 , ike phase fails due to timeout

Same credentials/secrets configured in both clients

Please note that crs125 has already a gre/ipsec tunnel with another remote RB2011

Is there any macro issue/mistake to check ??

Thank you

2

Same issue :

Connecting a remote routerboard in L2TP/IPSEC works from a 3g/4g client as well a windows10 client with a comon DSL router

Whe the client is behind a MT device the L2TP connection to a remote mikrotik L2TP/IPSEC server fails

Phase 1 and 2 seems to be completed but L2TP is not even started (looking at L2TP server log)

Any hint please ??

3

I would verify your Windows client is behaving properly. It appears Microsoft has a sorted history with NAT-T technologies.

https://answers.microsoft.com/en-us/windows/forum/windows_10-networking/l2tp-registry-change-to-work-with-nat-t-not/f864ba86-a01b-42b5-93cd-e70c5fdf4fb3?auth=1

It looks like you need to monkey with the registry. Alternatively you could look at native IPv6 on both sides if it is deployed to you or another VPN technology.

4

It works !!!

Thank you !

Briefly for who needs:

regedit
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
add new DWORD (32-bit) value named AssumeUDPEncapsulationContextOnSendRule
give it a value of 2
reboot

5

Idlemind, a great Thank You
:smiley:

6

No problem, glad it worked.