I am setting up a VPN for my daughter living in another state with insecure apartment network (see my earlier post: http://forum.mikrotik.com/t/which-vpn-configuration-for-apartment/119873/1)
Basically it will be [Daughter’s hAP Lite] → [NATed Apartment LAN] → [l2TP/IPsec VPN over internet] → [My Home Router RB951G-1HnD] → [Internet access for daughter]
I’ve tested the setup locally and it works, but the IPsec settings are driving me crazy. I understand that IPsec phase 1 is setup by the peer config in Mikrotik and phase 2 is the Proposal setting. I do not want SHA1 hash or 3DES encryption to even be options. I would like the hash to be SHA-256 and either aes128-cbc or aes256-cbc encryption along with PFS. It seems like no matter what I do, if I don’t have SHA1 checked as a hash option, I get a “No suitable proposal found” error in the log. Also, when a connection is successful, how do you know exactly what parameters were agreed upon? The log seems very vague (and is not searchable) and the status doesn’t tell you if PFS is being used or not. Is SHA1 is the only thing that works for phase1? Routers are running version 6.42.1. Please note that her router is doing “dial up” to mine. I can not do site to site VPN as I have no access to the apartment building hardware.