sstp-out1: terminating... - conn timeout

RouterOS General
1

Hello.
I have Mikrotik 1100AHx2 as sstp-server and 951Ui-2HnD as client.
and - i don’t understand, why… but, every 2 minutes sstp connection is terminating.

client side:

14:35:38 sstp,ppp,info sstp-out1: terminating… - conn timeout
14:35:38 sstp,ppp,info sstp-out1: disconnected
14:35:38 sstp,ppp,info sstp-out1: initializing…
14:35:38 sstp,ppp,info sstp-out1: connecting…
14:35:38 route,ospf,info OSPFv2 neighbor 10.200.0.1: state change from Full to Down
14:35:39 sstp,ppp,info sstp-out1: authenticated
14:35:39 sstp,ppp,info sstp-out1: connected

14:37:39 sstp,ppp,info sstp-out1: terminating… - conn timeout
14:37:39 sstp,ppp,info sstp-out1: disconnected
14:37:39 sstp,ppp,info sstp-out1: initializing…
14:37:39 sstp,ppp,info sstp-out1: connecting…
14:37:39 route,ospf,info OSPFv2 neighbor 10.200.0.1: state change from Full to Down
14:37:40 sstp,ppp,info sstp-out1: authenticated
14:37:40 sstp,ppp,info sstp-out1: connected

server side:

14:35:38 sstp,ppp,info : terminating… - terminated by remote peer
14:35:38 sstp,ppp,info,account ap0214 logged out, 121 9325 4459 77 75
14:35:38 sstp,ppp,info : disconnected
14:35:38 route,ospf,info OSPFv2 neighbor 172.20.18.30: state change from Full to Down
14:35:39 sstp,ppp,info,account ap0214 logged in, 10.200.18.247
14:35:39 sstp,ppp,info : authenticated
14:35:39 sstp,ppp,info : connected

14:37:39 sstp,ppp,info : terminating… - terminated by remote peer
14:37:39 sstp,ppp,info,account ap0214 logged out, 120 12554 7377 105 114
14:37:39 sstp,ppp,info : disconnected
14:37:39 route,ospf,info OSPFv2 neighbor 172.20.18.30: state change from Full to Down
14:37:40 sstp,ppp,info,account ap0214 logged in, 10.200.18.247
14:37:40 sstp,ppp,info : authenticated
14:37:40 sstp,ppp,info : connected


also, i have other 951Ui-2HnD with same config - and connection uptime is already 2 days.
Have any ideas about reasons ?

2

Can you post your config from each of the routers?

3

Sure.

750GL (client1, timeout, testing device)

apr/02/2014 08:22:45 by RouterOS 6.10

software id = WAE8-7XV2

/certificate
add common-name=ap0001 country=RU days-valid=3650 locality=Izhevsk name=ap0001 organization=Farmaimpex state=Udmurtia subject-alt-name=email:ap0001@farmaimpex.ru unit=Mikrotik
add common-name=CA country=RU key-size=4096 locality=Farmaimpex name=CA organization=Farmaimpex state=Udmurtia trusted=yes unit=Mikrotik
add common-name=ap0002 country=RU locality=Izhevsk name=ap0002 organization=Farmaimpex state=Udmurtia subject-alt-name=email:ap0002@farmaimpex.ru trusted=yes unit=Mikrotik
/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway
set [ find default-name=ether2 ] disabled=yes name=ether2-master-local
set [ find default-name=ether3 ] master-port=ether2-master-local name=ether3-slave-local
set [ find default-name=ether4 ] master-port=ether2-master-local name=ether4-slave-local
/ip neighbor discovery
set ether1-gateway discover=no
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=ether2-master-local name=default
/routing ospf area
add area-id=1.1.1.1 name=area1
/ip address
add address=192.168.88.1/24 comment="default configuration" interface=ether2-master-local network=192.168.88.0
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid disabled=no interface=ether1-gateway
add default-route-distance=2 dhcp-options=hostname,clientid disabled=no interface=ether5
/ip dhcp-server network
add address=192.168.88.0/24 comment="default configuration" dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.22.254
/ip dns static
add address=192.168.88.1 name=router
add address=217.14.197.69 name=mikrovpn.farmaimpex.ru
add address=62.141.80.66 name=mikrovpn.farmaimpex.ru
add address=78.85.39.200 name=mikrovpn.farmaimpex.ru
/ip firewall address-list
add address=195.225.38.62 list=allowed
/ip firewall filter
add chain=input comment="default configuration" protocol=icmp
add chain=input comment="default configuration" connection-state=established
add chain=input comment="default configuration" connection-state=related
add chain=input comment="default configuration" in-interface=ether1-gateway
add chain=forward comment="default configuration" connection-state=established
add chain=forward comment="default configuration" connection-state=related
add chain=forward comment="default configuration" connection-state=invalid
/ip firewall nat
add chain=srcnat dst-address-list=allowed
/ip route
add distance=1 dst-address=192.168.22.250/32 gateway=192.168.41.254
/ip upnp
set allow-disable-external-interface=no
/routing filter
add action=accept chain=ospf-in prefix=192.168.0.0/16
add action=accept chain=ospf-in prefix=10.0.0.0/8
add action=accept chain=ospf-in prefix=172.16.0.0/12
add action=discard chain=ospf-in
/routing ospf network
add area=backbone network=10.10.10.0/24
add area=area1 network=192.168.88.0/24
add area=area1 network=10.200.0.0/16
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=client2
/system ntp client
set enabled=yes mode=unicast primary-ntp=192.168.22.254
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=ether3-slave-local
add interface=ether4-slave-local
add interface=ether5
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=ether3-slave-local
add interface=ether4-slave-local
add interface=ether5
/tool netwatch
add down-script="ip dns set servers=[ip dns get servers]; ip dns cache flush;" host=192.168.22.254 interval=5m up-script="ip dns set servers=[ip dns get servers]; ip dns cache flush;"951 (client, timeout)

apr/02/2014 08:26:07 by RouterOS 6.10

software id = I7CM-LEB0

/certificate
add common-name=ap0214 country=RU locality=izhevsk name=ap0214 organization=Farmaimpex state=izhevsk subject-alt-name=email:ap0214@farmaimpex.ru trusted=yes unit=Mikrotik
/interface bridge
add admin-mac=D4:CA:6D:BB:19:63 auto-mac=no disabled=yes name=bridge-local
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-ht-above disabled=no distance=indoors l2mtu=2290 mode=ap-bridge ssid=MikroTik-BB1967
/ip neighbor discovery
set ether1 discover=no
/interface ethernet
set [ find default-name=ether4 ] master-port=ether5
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=secret wpa2-pre-shared-key=secret
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m mac-cookie-timeout=3d
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge-local name=default
/interface pppoe-client
add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 default-route-distance=1 dial-on-demand=no disabled=no interface=ether1 keepalive-timeout=60 max-mru=1480 max-mtu=1480 mrru=disabled name=pppoe-out1 password=
password profile=default service-name="" use-peer-dns=yes user=user
add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 default-route-distance=1 dial-on-demand=no disabled=no interface=ether2 keepalive-timeout=60 max-mru=1480 max-mtu=1480 mrru=disabled name=pppoe-out2 password=password2
profile=default service-name="" use-peer-dns=yes user=user2
/interface sstp-client
add add-default-route=no authentication=pap,chap,mschap1,mschap2 certificate=ap0214 connect-to:1443=mikrovpn.farmaimpex.ru dial-on-demand=no disabled=no http-proxy=0.0.0.0:443 keepalive-timeout=60 max-mru=1500 max-mtu=1500 mrru=
disabled name=sstp-out1 password=sstppassword profile=default user=ap0214 verify-server-address-from-certificate=no verify-server-certificate=no
/routing ospf area
add area-id=1.1.1.1 name=area1
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface bridge port
add bridge=bridge-local interface=ether2
add bridge=bridge-local interface=wlan1
/ip address
add address=172.20.18.30/28 interface=ether5 network=172.20.18.16
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether3
/ip dhcp-server network
add address=192.168.88.0/24 comment="default configuration" dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=192.168.22.254
/ip dns static
add address=192.168.88.1 name=router
/ip firewall address-list
add address=193.109.247.248 list=allowed
/ip firewall filter
add chain=input comment="default configuration" protocol=icmp
add chain=input comment="default configuration" connection-state=established
add chain=input comment="default configuration" connection-state=related
add action=drop chain=input comment="default configuration" disabled=yes in-interface=ether1
add chain=forward comment="default configuration" connection-state=established
add chain=forward comment="default configuration" connection-state=related
add action=drop chain=forward comment="default configuration" connection-state=invalid disabled=yes
/ip firewall nat
add action=masquerade chain=srcnat dst-address-list=allowed to-addresses=0.0.0.0
/ip route
add distance=1 dst-address=10.0.0.0/8 gateway=sstp-out1
add distance=1 dst-address=172.16.0.0/12 gateway=sstp-out1
add distance=1 dst-address=192.168.0.0/16 gateway=sstp-out1
/ip service
set api disabled=yes
/ip upnp
set allow-disable-external-interface=no
/routing ospf network
add area=area1 network=10.200.0.0/16
add area=area1 network=172.16.0.0/12
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=ap0214
/system leds
set 0 interface=wlan1
/system ntp client
set enabled=yes mode=unicast primary-ntp=192.168.22.254 secondary-ntp=62.141.80.66
/system script
add name=upgrade policy=ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api source="/system routerboard upgrade"
/tool netwatch
add down-script="ip dns set servers=[/ip dns get servers]; ip dns cache flush;" host=192.168.22.254 interval=5m up-script="ip dns set servers=[/ip dns get servers]; ip dns cache flush;"951, client, working:

apr/02/2014 08:29:44 by RouterOS 6.10

software id = GX9V-00D4

/certificate
add common-name=ap0680 country=RU locality=voronezh name=ap0680 organization=Farmaimpex state=voronezh subject-alt-name=email:ap0680@farmaimpex.ru trusted=yes unit=Mikrotik
/interface wireless
set [ find default-name=wlan1 ] l2mtu=2290 ssid=MikroTik
/interface ethernet
set [ find default-name=ether4 ] master-port=ether5
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m mac-cookie-timeout=3d
/interface sstp-client
add add-default-route=no authentication=pap,chap,mschap1,mschap2 certificate=ap0680 connect-to:1443=mikrovpn.farmaimpex.ru dial-on-demand=no disabled=no http-proxy=0.0.0.0:443 keepalive-timeout=60 max-mru=1500 max-mtu=1500 mrru=
disabled name=sstp-out1 password=sstppassword profile=default user=ap0680 verify-server-address-from-certificate=no verify-server-certificate=no
/routing ospf area
add area-id=1.1.1.1 name=area1
/ip address
add address=172.20.36.14/28 interface=ether5 network=172.20.36.0
add address=109.195.53.220/25 interface=ether1 network=109.195.53.128
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether3
/ip dns
set allow-remote-requests=yes servers=192.168.22.254,109.195.49.1,109.195.48.1
/ip firewall address-list
add address=193.109.247.248 list=allowed
/ip firewall nat
add action=masquerade chain=srcnat dst-address-list=allowed to-addresses=0.0.0.0
/ip route
add distance=1 gateway=109.195.53.254
add distance=1 dst-address=10.0.0.0/8 gateway=sstp-out1
add distance=1 dst-address=172.16.0.0/12 gateway=sstp-out1
add distance=1 dst-address=192.168.0.0/16 gateway=sstp-out1
/ip upnp
set allow-disable-external-interface=no
/routing ospf network
add area=area1 network=10.200.0.0/16
add area=area1 network=172.16.0.0/12
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=ap0680
/system leds
set 0 interface=wlan1
/system ntp client
set enabled=yes mode=unicast primary-ntp=192.168.22.254 secondary-ntp=62.141.80.66
/tool netwatch
add down-script="ip dns set servers=[/ip dns get servers]; ip dns cache flush;" host=192.168.22.254 interval=5m up-script="ip dns set servers=[/ip dns get servers]; ip dns cache flush;"1100, "server":

apr/02/2014 08:29:48 by RouterOS 6.10

software id = M88C-H51N

/certificate
add common-name=CA country=RU days-valid=3650 key-size=4096 key-usage=digital-signature,key-encipherment,data-encipherment,key-cert-sign,crl-sign locality=Farmaimpex name=CA organization=Farmaimpex state=Udmurtia trusted=yes unit=
Mikrotik
add common-name=server country=RU days-valid=3650 key-size=4096 locality=Farmaimpex name=server organization=Farmaimpex state=Udmurtia trusted=yes unit=Mikrotik
add common-name=ap0001 country=RU days-valid=3650 locality=Izhevsk name=ap0001 organization=Farmaimpex state=Udmurtia subject-alt-name=email:ap0001@farmaimpex.ru trusted=no unit=Mikrotik

/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m mac-cookie-timeout=3d
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=office ranges=10.200.0.0/24
add name=izhevsk ranges=10.200.18.0/24
add name=ufa ranges=10.200.2.0/24
add name=kazan ranges=10.200.16.0/24
add name=krasnodar ranges=10.200.23.0/24
add name=voronezh ranges=10.200.36.0/24
add name=kemerovo ranges=10.200.42.0/24
add name=kirov ranges=10.200.43.0/24
add name=lipetsk ranges=10.200.48.0/24
add name=novosibirsk ranges=10.200.54.0/24
add name=perm ranges=10.200.59.0/24
add name=tumen ranges=10.200.72.0/24
add name=surgut ranges=10.200.86.0/24
add name=urengoj ranges=10.200.89.0/24
/port
set 0 name=serial0
set 1 name=serial1
/ppp profile
set 0 only-one=no
add change-tcp-mss=yes local-address=10.200.0.1 name=office only-one=no remote-address=office
add change-tcp-mss=yes local-address=10.200.18.1 name=izhevsk only-one=no remote-address=izhevsk
add change-tcp-mss=yes local-address=10.200.2.1 name=ufa only-one=no remote-address=ufa
add change-tcp-mss=yes local-address=10.200.16.1 name=kazan only-one=no remote-address=kazan
add change-tcp-mss=yes local-address=10.200.23.1 name=krasnodar only-one=no remote-address=krasnodar
add change-tcp-mss=yes local-address=10.200.36.1 name=voronezh only-one=no remote-address=voronezh
add change-tcp-mss=yes local-address=10.200.42.1 name=kemerovo only-one=no remote-address=kemerovo
add change-tcp-mss=yes local-address=10.200.43.1 name=kirov only-one=no remote-address=kirov
add change-tcp-mss=yes local-address=10.200.48.1 name=lipetsk only-one=no remote-address=lipetsk
add change-tcp-mss=yes local-address=10.200.54.1 name=novosibirsk only-one=no remote-address=novosibirsk
add change-tcp-mss=yes local-address=10.200.59.1 name=perm only-one=no remote-address=perm
add change-tcp-mss=yes local-address=10.200.72.1 name=tumen only-one=no remote-address=tumen
add change-tcp-mss=yes local-address=10.200.86.1 name=surgut only-one=no remote-address=surgut
add change-tcp-mss=yes local-address=10.200.89.1 name=urengoj only-one=no remote-address=urengoj
set 15 only-one=no
/routing ospf area
add area-id=1.1.1.1 name=area1
/routing ospf instance
set [ find default=yes ] metric-default=20 metric-other-ospf=110 metric-rip=120 redistribute-connected=as-type-1 redistribute-other-ospf=as-type-1 redistribute-static=as-type-1
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface sstp-server server
set certificate=server enabled=yes port=1443 verify-client-certificate=yes
/ip address
add address=192.168.22.250/24 interface=ether2 network=192.168.22.0
/ip dhcp-client
add default-route-distance=0 dhcp-options="clientid,(unknown),hostname" disabled=no interface=ether1
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no interface=ether6
/ip dns
set servers=192.168.22.254
/ip route
add distance=1 gateway=192.168.22.254
add distance=1 dst-address=10.200.0.0/16 type=blackhole
add distance=1 dst-address=172.20.0.0/14 type=blackhole
/ip service
set api disabled=yes
/ip upnp
set allow-disable-external-interface=no
/ppp secret
add name=dyn password=password profile=office service=sstp
add name=ap0680 password=sstppassword profile=voronezh service=sstp
add name=client2 password=sstppassword profile=office service=sstp
add name=ap0214 password=sstppassword profile=izhevsk service=sstp
/routing filter
add action=accept chain=ospf-out prefix=10.0.0.0/8
add action=accept chain=ospf-out prefix=172.16.0.0/12
add action=accept chain=ospf-out prefix=192.168.0.0/16
add action=discard chain=ospf-out
/routing ospf network
add area=area1 network=10.10.10.0/24
add area=backbone
add area=area1 network=192.168.0.0/16
add area=area1 network=172.16.0.0/12
add area=area1 network=10.200.0.0/24
add area=area1 network=10.200.0.0/16
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=MikroRouter
/system ntp client
set enabled=yes mode=unicast primary-ntp=192.168.22.254

4

Are you using different certificates with each client? Trying using the working certificate on one of the non-working clients and see if that resolves the problem. If it does, then at least, we now where to go from there.

5

Well… upgraded ‘server’ (1100) from 6.10 to 6.11. Now sstp-client is not able to connect - client write to log:
22:15:13 sstp,ppp,info sstp-out1: initializing…
22:15:13 sstp,ppp,info sstp-out1: connecting…
22:15:13 sstp,ppp,info sstp-out1: terminating… - internal error (6)
22:15:13 sstp,ppp,info sstp-out1: disconnected
22:15:23 sstp,ppp,info sstp-out1: initializing…
22:15:23 sstp,ppp,info sstp-out1: connecting…
22:15:23 sstp,ppp,info sstp-out1: terminating… - internal error (6)
22:15:23 sstp,ppp,info sstp-out1: disconnected
22:15:33 sstp,ppp,info sstp-out1: initializing…
22:15:33 sstp,ppp,info sstp-out1: connecting…
22:15:34 sstp,ppp,info sstp-out1: terminating… - internal error (6)downgraded to 6.7
It works! now sstp-clients work fine.
uptime=6m36s

will see for updates…

6

downgraded to 6.7
It works! now sstp-clients work fine.
uptime=6m36s

Are all of your clients working now?

7

Yes, they all working now. did not disconnected since last connect…

8

Awesome!

9

I’m seeing this exact problem too, downgrading to 6.10 “fixes” it.

10

Well, I am experiencing the same issue as documented in this thread. I’m using encryption with certificates between client and server. v6.7 is stable, but no information is provided as to whether the connection is actually encrypted. The SSTP “encoding” field remains blank in v6.7. Upgrading through versions up to and including v6.13 causes SSTP connections to stop passing data after 120 seconds (even if the timeout value is set to something higher than 60). This behavior only starts to occur after the SSTP session is interrupted for the first time. The connection will be stable for hours or days, but once it reconnects, it stops passing data after 120 seconds. Keep-alive logic will restart the connection, but it fails again after 120 seconds. Very annoying…

FYI…v6.10 did not seem to correct the problem for me…I had to downgrade to v6.7 to obtain stability.

11

Welcome on the board… i have exactly the same issue.

12 
17:04:25 sstp,ppp,info MIS: initializing... 
17:04:25 sstp,ppp,info MIS: connecting... 
17:04:27 sstp,ppp,info MIS: terminating... - terminated by remote peer 
17:04:27 sstp,ppp,info MIS: disconnected 
17:04:37 sstp,ppp,info MIS: initializing... 
17:04:37 sstp,ppp,info MIS: connecting... 
17:04:38 sstp,ppp,info MIS: terminating... - terminated by remote peer 
17:04:38 sstp,ppp,info MIS: disconnected

Same issue here, after upgrading sstp-server side to 6.13. It is now broken. Downgraded to 6.10 seems to have solved the issue.

13

I just tested reupgrading the client. If the sstp-client is v6.13, no issue. I guess the bug is the sstp-server part in v6.13, not the sstp-client.

14

As I just see this thread, I opened a ticket and finally was told this should be fixed in 6.14

15

With 6.15 now the connection is not dropped anymore when idle but as soon as the full bandwith is used for transfer the issue described here comes again.

The number of times the conn timeout comes seems to be dependent on the value of “Keepalive Timeout” set on the SSTP-Server and the SSTP-Client.
Setting this value to 600 for example I didn’t get a conn timeout, but with a value of 10 this comes about 1-2 times an hour.

In the wiki this is about this value:

If server during keepalive period does not receive any packet, it will send keepalive packets every second five times. If the server does not receives response from the client, then disconnect after 5 seconds. Logs will show 5x “LCP missed echo reply” messages and then disconnect.

So as far as I understand should this value should definitely cause no issue if other data is transferred anyway?
Should appear “CLP missed echo reply” … which doesn’t

But the connection drops are dependent of that value…

Can you please fix this sstp-stuff?

16

Hi guys,

I am experiencing the same problem. However, I am running 6.24 on both, client and server (both RB750). The server uses a self-signed cert, the clients do not validate cert and are just using username and password. I just receive

LCP down event in inial state

and

LCP lowerdown

on the server side. Client wise, I get

terminating... - internal error (6)
LCP lowerdown
LCP down event in initial state

Any chances another / newer firmware will fix this eventually? Otherwise I need to downgrade to 6.7 again, which worked fine for quite some times …

17

6.31 has this problem
server is softether sstp