And I’ve verified that the required loadable modules don’t error on manual modprobe.
So I’m at the point where I’m thinking something is incompatible between these two implementations, and looking for some much needed advice. I can connect without mppe, but I want to use it in lieu of IPSec which would consume much higher cpu overhead on a large number of concurrent streams. I don’t need bullet-proof encryption for the application – and this SHOULD work!
Well, I’m glad I could have this conversation with myself!
Hope this helps someone in the future…
RouterOS Version was the problem.
The trouble occurred on v5.24
So RouterOS v5.24 has a serious bug in the l2tp client, which prevents it from negotiating mppe encryption is a perfect match is not had on the very first attempt.
I tested on a 6.5 and it worked perfectly.
May 2 21:00:09 ubuntu pppd[2714]: sent [CCP ConfReq id=0x1 <mppe +H -M +S +L -D -C>]
May 2 21:00:09 ubuntu pppd[2714]: rcvd [IPCP ConfReq id=0x4 <addr 0.0.0.0>]
May 2 21:00:09 ubuntu pppd[2714]: sent [IPCP TermAck id=0x4]
May 2 21:00:09 ubuntu pppd[2714]: rcvd [CCP ConfReq id=0x3 <mppe +H -M +S +L -D -C>]
May 2 21:00:09 ubuntu pppd[2714]: sent [CCP ConfNak id=0x3 <mppe +H -M +S -L -D -C>]
May 2 21:00:09 ubuntu pppd[2714]: rcvd [CCP ConfNak id=0x1 <mppe +H -M +S -L -D -C>]
May 2 21:00:09 ubuntu pppd[2714]: sent [CCP ConfReq id=0x2 <mppe +H -M +S -L -D -C>]
May 2 21:00:09 ubuntu pppd[2714]: rcvd [CCP ConfReq id=0x4 <mppe +H -M +S -L -D -C>]
May 2 21:00:09 ubuntu pppd[2714]: sent [CCP ConfAck id=0x4 <mppe +H -M +S -L -D -C>]
May 2 21:00:09 ubuntu pppd[2714]: rcvd [CCP ConfAck id=0x2 <mppe +H -M +S -L -D -C>]
May 2 21:00:09 ubuntu pppd[2714]: MPPE 128-bit stateless compression enabled
RouterBOARD 962UiGS-5HacT2HnT
Current firmware: 6.42.1
The Mikrotik can not establish a connection with mppe encryption (w/o IPSEC, because it is very difficult in our case to redirect the entire local network to the Internet through a third-party gateway, to circumvent censorship in our country ). I spent almost all day today. Believe me, I just did not do with the config server and profile settings in Microtics. Including led config server to the form above.
Apr 29 23:34:46 host pppd[15876]: MPPE required but peer negotiation failed
...
Apr 29 23:34:46 host xl2tpd[15718]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
Apr 29 23:34:46 host xl2tpd[15718]: Connection 1514 closed to xx.xx.xx.xx, port 1701 (Result Code: expected at least 10, got 8)
CentOS Linux 6.9
Kernel and CPU Linux 2.6.32-696.23.1.el6.x86_64 on x86_64
Plugin pppol2tp.so loaded. (was checked including without him)
xl2tpd version: xl2tpd-1.3.8
pppd version 2.4.5
Is there any hope that this will be repaired for Microtics? For example, a connection with the encryption requirement, on the same server with the same parameters from the Windows client passes without problems.
p.s. From Windows just now, on the current server config:
Apr 30 00:11:28 host xl2tpd[16226]: Call established with xx.xx.xx.xx, Local: 18539, Remote: 1, Serial: 0
Apr 30 00:11:28 host pppd[16331]: Plugin pppol2tp.so loaded.
Apr 30 00:11:28 host pppd[16331]: pppd 2.4.5 started by root, uid 0
Apr 30 00:11:28 host pppd[16331]: Using interface ppp0
Apr 30 00:11:28 host pppd[16331]: Connect: ppp0 <-->
Apr 30 00:11:28 host pppd[16331]: Overriding mtu 1500 to 1450
Apr 30 00:11:28 host pppd[16331]: Overriding mru 1500 to mtu value 1450
Apr 30 00:11:28 host pppd[16331]: MPPE 128-bit stateless compression enabled
Apr 30 00:11:30 host pppd[16331]: Cannot determine ethernet address for proxy ARP
Apr 30 00:11:30 host pppd[16331]: local IP address 10.99.96.1
Apr 30 00:11:30 host pppd[16331]: remote IP address 10.99.96.12
