ROS 6.44 - VPN L2TP not working

After upgrade from ROS 6.43.12 to 6.44 - I have lost possibility co connect to my MT with L2TP (with preshared key) VPN. I was changing firewall settings, trying other… but after downgrade to 6.43.12 - IT WORKS AGAIN. So something is BAD with ROS 6.44 and L2TP VPN ! MikroTik team - please repir that ROS 6.44 BUG.

I found that simply disabling and re-enabling the L2TP server resolved the problem.

/interface l2tp-server server set enabled=no
/interface l2tp-server server set enabled=yes

Works like a charm for me. What did the log say?
Also did you try a reboot again after the upgrade? I always reboot twice after a upgrade. Once for the upgrade and another for the firmware. If there was a issue with this during the first boot I would not have noticed.

Hmm, my site-to-site tunnels where converted correcty, but my roadwarrior PSK does not work anymore …

“parsing packet failed, possible cause: wrong password”

until 6.43.12 it worked ok

Strange behavior, but this works for me!
Tnx!

Really strange, but after “second upgrade” (this night) to ROS 6.44 - it works OK. VPN is connecting.

The issue will be fixed in the next RouterOS release.

universal answer :laughing:

@emils nice that this problem is allready known.

in my case below is the relevant part of the config :

/ip pool
add name=dyn-vpn ranges=192.168.88.2-192.168.88.19

/ppp profile
add change-tcp-mss=yes dns-server=192.168.88.1 local-address=192.168.88.1 \
    name=ppp-in only-one=no remote-address=dyn-vpn use-encryption=required \
    use-ipv6=no use-mpls=no

/interface l2tp-server server
set allow-fast-path=yes authentication=mschap2 default-profile=ppp-in enabled=yes ipsec-secret=SERVERPASS max-mru=1460 max-mtu=1460 use-ipsec=yes

/ppp secret
add name=dynuser1 password=DYNUSER1PASS profile=ppp-in

this creates a dynamic ipsec peer as in the documentation ( https://wiki.mikrotik.com/wiki/Manual:Interface/L2TP )
It worked nice until ros 6.43.12 but in 6.44 I get “parsing packet failed, possible cause: wrong password”

But - there is answer! They found bug and will repair it - it’s important that they looking for… and repairing.



What’s new in 6.45beta6 (2019-Mar-05 08:51):

*) ipsec - fixed dynamic L2TP peer and identity configuration missing after reboot (introduced in v6.44);

Hopefully we won’t have to wait to long for this fix in current …

I tried this beta but it did not solve my problems … L2TP server with PSK is not working

Please write to support@mikrotik.com with .rif file attached.

done :wink:

that was FAST ! Emils thanks for your help !!!

it seems the way dynamic peer configuration from L2TP server were added to the peers menu changed between 6.43.12 and 6.44
dynamic peers take precedence BEFORE static peer entries …

In my case there was a static default PEER with a password used by all my roadwarrior clients.
The dynamic peer (from the L2TP server entry) had a typo in the password but that never was used.
until now …

changed the password and all my clients are working again !

kudos to support, extra kudos to emils

thanks

Could you please have a look at my issue:
http://forum.mikrotik.com/t/ros-6-44-breaks-l2tp-ipsec/128545/1
Can you please confirm if the issue is same and will be fixed on next version release as well?

Cheers

Read this: http://forum.mikrotik.com/t/ipsrc-peers-peer1-with-dinamic-ip/128331/10

If I upgrade to 6.44.1 will it fix the issue without changing the config?

Upgrading 6.44.1 broke my firewall forwarding chains.