VPN with 2FA

RouterOS Security
1

Hi All,

So, had a redundant router setup running the latest ROS version 6 and integrated with Rulon 2FA for users logging in via L2TP/IPsec server. So far so good, works perfectly.

One of the routers (a CCR1036) died and have decided to upgrade to the newest CCR2118. However, this comes with in my opinion a castrated OS. Just because the World has decided that L2TP is not the most secure, ROSv7 removes it. Since the HW is recent, I cannot reverse back to ROS v6 either.

Rublon (and all other similars out there including Duo, MiniOrange, Protectimus, etc) do not handle any other types of VPN for MFA and this leaves me in a quandry.

Have you managed to implement, at ROSv7 and above, a 2FA solution involving VPN access with 2FA and against internal RADIUS server authentication?

Thank you in advance.
M.

2

did you look at this ?

/system/device-mode/print 
                 mode: advanced     
     allowed-versions: 7.13+,6.49.8+
              flagged: no           
     flagging-enabled: no           
            scheduler: yes          
                socks: yes          
                fetch: yes          
                 pptp: yes          
                 l2tp: yes          
       bandwidth-test: yes          
          traffic-gen: no           
              sniffer: yes          
                ipsec: yes          
                romon: yes          
                proxy: yes          
              hotspot: yes          
                  smb: no           
                email: yes          
             zerotier: yes          
            container: no           
  install-any-version: no           
           partitions: yes          
          routerboard: yes          
        attempt-count: 0
3

The world, and Mikrotik, are correct.

4

No, thank you. I’ll take a look.

5

Yes, agreed. But the option should still be available. There are many more obvious security issues but few have been chopped off like L2TP/IPsec, also from Android.

6

OVPN does work perfectly fine with 2FA

7

As hinted, it wasn't taken away, and it works perfectly. It just comes disabled by default and you have to enable it.

8

Use "service=ipsec" instead of "service=login":