Hello,
We upgraded from a very old version of RouterOS to 6.45.1
it completely scrambled the IPSec settings
I have been trying to rebuild it following online how-to guides
but the way IPSec settings are now in winbox are completely different than anything I can find online
I don’t see anything setup for ike2 so I’m very confused
dose anyone on here have an updated link showing how to setup LT2P VPN Server with IPSec??
Thanks
Sob
August 1, 2019, 2:08pm
2
I don’t have any up to date tutorial. But it’s very similar, only what was previously in one place is split into multiple parts (it gives more flexibility how to do stuff). If you have previously working config, you just need to find where each option went, but it should be there somewhere.
Our working config was scrambled in the upgrade in the ipsec section
I have followed the tutorials best I can redoing L2TP ipsec road worrier with 256 encryption
Clinet trying to connect gets unsuccessful
And the ipsec server logs say ike2 no configuration for the IP of clinet trying to connect
I really don’t understand the ike2 error as I did not setup anything for ike2
sindy
August 2, 2019, 8:04am
4
Can you /export hide-sensitive the current configuration (at least the scrambled IPsec part as well as the L2TP part)? Maybe we can find a way to tidy it up.
Here is the config after I followed online how to guides
if you guys can please tell me what I’m doing wrong our road worriers really need the VPN back
Thanks!
/ppp profile
/ip ipsec profile
sindy
August 5, 2019, 10:39am
6
In the L2TP part, you forgot to post the /interface l2tp-server server part. That’s why it always better to post the complete export and just obfuscate the sensitive information (see the hint in my automatic signature below). So either do that or post at least /interface l2tp-server export verbose hide-sensitive and /ip firewall export .
I can see that you have modified the default proposal (for phase 2) but added your own profile (for phase 1), is it because you use IPsec on the machine for anything else than L2TP? Also, can you change policy-generate from port-override to port-strict in the identity?
the output is from
ip ipsec export file=
and
ppp export file=
I don’t know why there is missing information
I have tried the port settings both ways
the ports are open in the firewall I just tried the override in hopes it would push things through
here is the interface
/interface l2tp-server server
/ip firewall layer7-protocol(get|GET).+(torrent|kat.cr|kickasstorrent|the $”
add address=10.0.0.0/8 list=rfc1918
/ip firewall connection tracking
there is the firewall yes I know its a mess fixing it is a work in progress
sindy
August 5, 2019, 11:09am
11
OK. So you ask RouterOS to generate the settings for L2TP for you using the default profile , proposal , and template in the default policy group by setting use-ipsec=required in /interface l2tp-server server , but at the same time you have created a peer and identity on your own, so there may be a collision. I would recommend to remove the manually added peer and identity, set the encryption and authentication algorithms you need for your client devices in the default profile , disable and re-enable the /interface l2tp-server server and see whether it becomes better. /ip ipsec peer print and /ip ipsec identity print should show you a peer and identity with a D in the second column, informing you that these items were dynamically created.
If your clients use Windows 10, it may be even more colourful as mine stopped even attempting L2TP/IPsec connection after one of the recent updates. So /tool sniffer quick port=500 is the first thing to run if the changes above don’t help, to check that some connection attempts from clients do arrive.
OK, so I removed what you said
But when I re-enabled the L2TP server the log is showing failed to bind to ::[500] bad file descriptor
sindy
August 5, 2019, 11:37am
13
The failed to bind message is a cosmetic issue as you have disabled IPv6, it’s not the reason why it doesn’t work. Set /system logging print add topics=ipsec,!packet and see whether the log shows anything when the client tries to connect.
when client tries to connect I get ipsec error “IP” peer sent packet for dead phase2
also that set commnad dose not seem to work
but I already have ipsec debug enabled for the logs
sindy
August 5, 2019, 11:46am
16
Have you added the log topic I have suggested? Because if you did, you have to see tons of ipsec,info messages. How exactly did you set the debug?
emils
August 5, 2019, 11:52am
17
I would guess the policy generation fails since it does not match the policy template:
/ppp profile
add change-tcp-mss=yes local-address=10.222.22.1 name=\
"L2TP Remote Connection" remote-address="VPN Pool" use-encryption=\
required
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=10.222.22.1/32
So Do I delete the IPsec policies??
what do I need to do to fix it?
I’m a neewbie when it comes to mikrotik sorry
the other issue is I’m out of the country and the firewall is blocking the country I’m in
so each time I need to test I have to contact somone in the states to test the VPN
if you can please give me a terminal command to allow my WAN to VPN you will be a hero
sindy
August 5, 2019, 12:13pm
20
Just remove the src-address-list from the rules permitting access to UDP ports 500 and 4500