Mikrotik 6.45.1 L2TP IPSec not working need updated guide

RouterOS General
21

OK,

So Now when I try to conenct from ether windows 10 or an android

I get in the ipsec debug

-agreed on pre-shared key auth

then it keeps resending packets "sent phase 1 packet (VPN Server IP)[500]<=>(IP of clint)[11809]

it retrys he same thing over and over and re send them a few times after the clint gives up on trying to connect

( I also removed the Acces list from the ports thanks)

22

getting the mikrotik phase 1 negotiation failed due to time up error now

23

seems my issue now is the default ipsec polices uses port strict and I’m behind NAT

is there a way to change the default as you guys told me to remove the polices that I made..

24

Port strict and NAT are unrelated. What is related is that at least Microsoft VPN client needs to be tweaked in registry to accept an L2TP server listening on a private address behind a NAT. But it can also be done without tweaking the registry using the method described here.

But as you stubbornly refuse to post obfuscated but otherwise complete configuration export, I’m only guessing that the Mikrotik itself is behind a NAT. If it is not, restricting the src-address of the policy template to a single private address is a nonsense. So either you’ve obfuscated an IP which is actually a public one using a private one, or I don’t understand how the config could have worked before the upgrade because the NAT detection mechanism is the same all the time and the intolerance of the Windows client to server-side NAT lasts for years. My only explanation for that is that the Windows settings permit fallback to IPsec-less L2TP and it worked that way all the time.

So:

  • post the complete config and obfuscate public addresses, if any, using symbolic names rather than randomly generated digit strings
  • if the Mikrotik doesn’t have a public IP on itself, provide a network diagram from the interface on the external device which holds the public IP down to the Mikrotik
25

first off thanks for your help

2nd I’m not stubernly refusing to post the full config I just don’t have the time to edit the full config right now as its huge

I have posted all the short configs you have asked for

and I replaced the public IP with “removed”

the Mikrotik is sitting on a public IP and is NOT behind NAT

then the mikrotik has a VPN pool to NAT the VPN Clients


this config is extremely basic I know its just something simple i’m missing

I will try and post full config we I can get some more time

26

If the Tik sits on public IP, then the restriction of the policy template’s src-address to 10.222.22.1 is a nonsense, as the policy needs to be bound to the public IP.

But this mistake is not the reason why the phase 1 packets from Tik’s port 500 to client’s port 11809 do not get through.

It would be fine if you could use the /tool sniffer quick port=500 command shown above to see whether these packets (the client port will be different this time) are really sent out or not. Because if they are, the issue is not in the Mikrotik and it may be some super-paranoid firewall between your test client and the Tik’s network what doesn’t let them through.

27

I fixed this on my own it was a simple encryption misconfig and also as you mentioned about the wrong src address

I now have it working with 256 aes encryption

thanks to everyone that helped

28

Hi,
Can you tell me please what did you do exactly?
After update to 6.46.6, l2tp/ipsec doesn’t work anymore (I made no modification settings).

29

Well … seems nobody cares.
Changed to ubiquiti. All good.
Never again mikrotik.
Now I have to change all others (43 routers).

30

Start your own thread, WTF do you expect people to answer your questions here…

31

Forum rules say to search 1st and not open another thread for the same problem.
As I did.
Now this is not ok. WTF?