L2TP Over IPSec with OSX Not Working?

RouterOS General
1

Basically the error I am getting is that OSX doesn’t get a response from the L2TP Server. I have disabled my firewall completely…

Here is L2TP Server:
/interface l2tp-server server
set authentication=mschap2 default-profile=L2TP-Roadwarrior enabled=yesHere is IPSec:
/ip ipsec policy group
add name=l2tp-roadwarrior
/ip ipsec proposal
add enc-algorithms=3des,aes-256-cbc name=l2tp-roadwarrior pfs-group=none
/ip ipsec peer
add comment=“L2TP Roadwarrior” enc-algorithm=3des exchange-mode=main-l2tp
generate-policy=port-override nat-traversal=yes policy-group=
l2tp-roadwarrior secret=
KEY
/ip ipsec policy
add comment=“L2TP Roadwarrior” group=l2tp-roadwarrior proposal=
l2tp-roadwarrior template=yesHere is PPP:
/ppp profile
add bridge=bridge-vpn change-tcp-mss=yes dns-server=10.1.200.1
incoming-filter=ppp-in local-address=10.1.200.1 name=L2TP-Roadwarrior
outgoing-filter=ppp-out remote-address=l2tp-pool
/ppp secret
add name=USER password=
PASSWORD profile=
L2TP-Roadwarrior service=l2tp
What am I missing?

2

My best guess is:

Your client, the Mac, has to connect to the IP address on the mikrotik which will be the preferred source IP for packets returned to your client.

The MikroTik does not reply from the IP address to which your client connected. It’s an annoying bug. If you have multiple paths out of the MikroTik, the client has to connect to the preferred source IP on the MikroTik for the interface closest to the client. If the client moves around, this is a big annoyance.

3

Negative. Both of them are in my lab setup. The client and server are in 10.0.0.0/24. The server has an internal network of 10.0.1.0/24… I’m planning to install it this Sunday and I can continue to troubleshoot it after its installed… I was just trying to figure it out now..

Any other ideas?

4

Next series of wild guesses…

6.10? has problems with aes-256 IIRC

KNOWN ISSUE: IPsec AES-CBC 256 Bit encryption algorithm doesn’t work in some cases. Use 128 bit AES, or hold on for v6.11

I have no idea how that problem would present in MacOS X errors.

What are the ppp-in/ppp-out filters?

Does the router have multiple 10.0.0.0/24 IPs on that interface?

I have given up on 6.7 and up for IPSec. I have actually back-leveled anything that needs to be a VPN server to 6.4 or 5.26. I do not have a lot of VPN experience but have run into a lot of problems with VPN and MikroTik lately.

I would enable IPsec and L2TP debug on the tik and watch the /var/log/system.log on the Mac. I even went so far as to enable /ip firewall filter log rules for the IPSec and L2TP ports.

When I was fighting the error you are getting, everything looked good in all of that but until I hit the IP listed in /ip route for the routes pointing back at my Mac, all I got was the message you seem to be getting.

5

Well thats good to know. Eventually I’ll have to get 6.12 or 6.13 on this so I can get all of the CRS switch chip to work.

But thanks for the info. I’m going to test it again after I install the router. Thankfully the VPN needs are minimal right now. I can install it and then just use a firewall allow to let just my home ip in to play with it.

-Eric