Hi
I’m using L2TP/IPSec VPNs for many years on mikrotiks. Latest router os have nice option for L2TP Server: UseIPSec which then automatically create IPSec policy and peer for roadwarriors.
Unfortunately, it doesn’t work well on some routers.
For example:
RB2011UiAS upgraded from 6.2x to 6.38.5 and the auto-generated IPSec Peer for ::/0 has Policy Template Group set to unknown, which results in connection error:
ipsec, error, “x.x.x.x failed to pre-process ph2 packet”
3 DR address=::/0 passive=yes auth-method=pre-shared-key
secret=“” generate-policy=port-strict
policy-template-group=*2 exchange-mode=main-l2tp
send-initial-contact=yes nat-traversal=yes proposal-check=obey
hash-algorithm=sha1 enc-algorithm=aes-256,aes-192,aes-128,3des
dh-group=modp1024 lifetime=1d dpd-interval=2m dpd-maximum-failures=5
There is only one IPSec Group called “default”, represented in another IP Sec Peers definitions as *FFFFFFFF. But in case above it is *2 which is wrong (Winbox show ‘unknown’).
Upgrade to latest 6.39.1 doesn’t help.
As a workaround I use manually created Peer definition for 0.0.0.0 but the above is a bug.
Please fix.