L2TP over IPSEC with certs

RouterOS Beginner Basics
1

Hello!
I am trying to configure L2TP over IPSEC VPN for Windows roadwarriors with certificate authentication.

I used http://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Road_Warrior_setup_with_RSA_Authentication
but the manual is siriously bugged, for example:
/certificate sign-ca or sign-issued doeesn’t exists (RouterOS 6.12).

My config:

/certificate
add name=“_keyCA” common-name=“_keyCA” key-size=2048 days-valid=1825 key-usage=code-sign,content-commitment,crl-sign,data-encipherment,digital-signature,key-agreement,key-cert-sign,key-encipherment
sign ca-crl-host=192.168.1.1 template=_keyCA

add name=“_keySVR” common-name=“_keySVR” key-size=2048 days-valid=1825
create-certificate-request template=_keySVR
sign ca=_keyCA template=_keySVR
set _keySVR trusted=yes

add name=“client1” common-name=“client1” key-size=2048 days-valid=1825
create-certificate-request template=client1
sign ca=_keyCA template=client1

/ip ipsec policy group add name=ipsecGroup
/ip ipsec policy add dst-address=192.168.192.0/24 group=ipsecGroup src-address=0.0.0.0/0 template=yes
/ip ipsec peer add auth-method=rsa-signature certificate=_keySVR exchange-mode=main generate-policy=port-override passive=yes policy-group=ipsecGroup remote-certificate=none hash-algorithm=md5 enc-algorithm=3des nat-traversal=yes

/interface l2tp-server add name=serwerL2TP
/interface l2tp-server server set authentication=mschap2 default-profile=default-encryption enabled=yes

… and I’m stuck. How to combine L2TP with IPSEC?
Please, please help me :slight_smile:

2

Hello,


I am trying to configure L2TP over IPSEC VPN for Windows roadwarriors with certificate authentication.

For road warriors I will suggest you to take plain IPSec without L2TP