L2TP over IPSec - BROKEN?

RouterOS General
1

I am using a fairly new router with 6.40.3. I have setup L2TP/IPSec many times but am killing myself on this current implementation. Reading the forums it seems like L2TP has gone off the rails in recent versions revolving around the policy-template-group setting in your peer (seen the solution of entering *FFFFFFFF in a terminal window).

Does anyone have this working in this version of RouterOS - no matter what I try I get the ‘x.x.x.x failed to pre-process ph2 packet’ - attempting with a Windows client.

My Peer
2 R address=0.0.0.0/0 passive=yes auth-method=pre-shared-key secret=“secret here”
generate-policy=port-strict policy-template-group=randomname
exchange-mode=main-l2tp send-initial-contact=yes nat-traversal=yes
proposal-check=obey hash-algorithm=sha1 enc-algorithm=aes-128,3des
dh-group=modp1024 lifetime=1d dpd-interval=2m dpd-maximum-failures=5

My Default Proposal
0 * name=“default” auth-algorithms=sha256,sha1
enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des lifetime=30m
pfs-group=none

2

First of all, please make sure you have Policy Group with name ‘randomname’ configured under ‘/ip ipsec policy group’ menu. Then make sure you have a policy template which would match L2TP policies with the same Policy Group configured.

You can also enable IPsec debug logs that will reveal extra debug information about the issue.

/system logging add topics=ipsec,!debug

If you are not able to resolve the issue yourself, please post your ‘/ip ipsec policy’ and ‘/ip ipsec policy group’ prints too.

3

I have this working, between two Mikrotik routers.

My peer:
address=::/0 passive=yes auth-method=pre-shared-key secret=“” generate-policy=port-strict policy-template-group=default exchange-mode=main-l2tp send-initial-contact=yes nat-traversal=no proposal-check=obey hash-algorithm=sha1 enc-algorithm=aes-256,aes-192,aes-128,3des dh-group=modp2048,modp1024 lifetime=1d dpd-interval=2m dpd-maximum-failures=5

My proposal:
name=“default” auth-algorithms=sha1 enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc lifetime=30m pfs-group=modp1024

It was working with 6.40.3 on both sides. Now it is working with 6.40.4 on the server and 6.40.3 or 6.40.4 on the clients. Don’t remember if worked with nat-traversal=yes. This is not an issue in my case, so I left it disabled.