Wireguard and L2tp/IPSEC Incompatibility

RouterOS General
1

I have two sites which are connected via a L2TP/IPSEC VPN. Everything works fine, the connection, the routing, etc..

I wanted to try WIreguard to connect both Mikrotik ROuters and it was not working until I disabled the L2TP/IPSEC. Once I disable the Lt2p/IPSEC VPN , the wireguard work correctly and traffic can flow through that interface.


Why are they not compatible?

2

They are, you can have both these tunnels in parallel, but you have to take some measures. The IPsec policy used to transport the L2TP packets must selectively match on UDP port 1701, which is the case if you let RouterOS create it for you but may not be the case if you have configured the IPsec part manually, so you may end up with “Wireguard over IPsec”. And you have to use proper routing of the payload so that you can control which payload uses which tunnel if both are active.

Without seeing the export of configurations of both devices, nothing more exact can be said.

3

Thanks for the prompt response. How do I configure IPSEC Policy to use Port 1701 for L2TP packets?

4

ip ipsec policy/
src-port=1701
dst-port=1701
protocol=udp

Make sure is in transport mode

5

Thanks, it works. I have both tunnels working!!