Community discussions

MikroTik App
 
ALEX63RU
just joined
Topic Author
Posts: 3
Joined: Tue Mar 31, 2009 1:45 pm

Mikrotik as cisco VPN client

Tue Mar 31, 2009 1:54 pm

I have group login and password

also have user login and password

Can Mikrotik as cisco VPN client ??????
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24493
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Mikrotik as cisco VPN client

Tue Mar 31, 2009 1:58 pm

No answer to your question? How to write posts
 
ALEX63RU
just joined
Topic Author
Posts: 3
Joined: Tue Mar 31, 2009 1:45 pm

Re: Mikrotik as cisco VPN client

Wed Apr 01, 2009 6:11 am

Remote peer is not pptp server ---------------------is cisco ASA
on my Ubuntu I use vpnc - client for Cisco VPN3000 Concentrator, IOS and PIX

sudo vpnc
Enter IPSec gateway address: 1.1.1.1
Enter IPSec ID for 1.1.1.1: xxxxxxxxxx
Enter IPSec secret for xxxxxxx@1.1.1.1:yyyyyyy
Enter username for 1.1.1.1: test
Enter password for test@1.1.1.1:zzzzzzzzzzzzzz
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24493
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Mikrotik as cisco VPN client

Wed Apr 01, 2009 9:13 am

No answer to your question? How to write posts
 
savage
Forum Guru
Forum Guru
Posts: 1220
Joined: Mon Oct 18, 2004 12:07 am
Location: Cape Town, South Africa
Contact:

Re: Mikrotik as cisco VPN client

Wed Apr 01, 2009 9:36 am

It's actually not Normis.

The Cisco VPN and associated VPN Client, uses propriatory extensions. I'd also be very interested in this. Tried a while ago, but gave up after a few weeks of not getting it to work.

From what I understand, it's a combination of IPSec and L2TP, but afaik - was never able to get it working.
Regards,
Chris
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24493
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Mikrotik as cisco VPN client

Wed Apr 01, 2009 9:37 am

you need to post logs from both sides. many people use it and it works
No answer to your question? How to write posts
 
mravojed
just joined
Posts: 3
Joined: Wed Apr 01, 2009 10:34 pm

Re: Mikrotik as cisco VPN client

Wed Apr 01, 2009 10:39 pm

I am also interested in this. However, at the moment, I have no clue on where to start? I would be happy to provide logs, but with all the info I have that I use with vpnc, I am yet to find howto or documentation on where to input all these:
IPSec gateway xx.yy.zz.qq (public ip of cisco box)
IPSec ID tunnel-id
IPSec secret somesecretword
Xauth username myname
Xauth password mypassword
 
spiderik
just joined
Posts: 1
Joined: Tue Aug 11, 2009 11:25 am

Re: Mikrotik as cisco VPN client

Tue Aug 11, 2009 11:30 am

Hey I am also very interested in this one. I have tried several howtos and I am playing with that already some 3weeks and can not get anywhere. I would really appreciate anybody who has this working to show up the light at the end of the VPN tunnel :)
 
thadem
Member Candidate
Member Candidate
Posts: 115
Joined: Fri Apr 18, 2008 1:40 am

Re: Mikrotik as cisco VPN client

Tue Aug 11, 2009 4:35 pm

a plain cisco-vpn (afaik its called dvpn) cannot be used with a mt-device, otherwise on a linux box you wouldn't need vpnc but could use openswan which does ipsec, but thats not the case. the protocol is ipsec, but modified and with some dirty hacks imho :-)
what you can do is configure a proper ipsec-connection on the asa and use that with mikrotik.

that http://wiki.openswan.org/index.php/Openswan/CiscoPIX should give you an idea.
 
User avatar
mushmx
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Sat Jul 21, 2007 7:01 pm
Location: Mexico

Re: Mikrotik as cisco VPN client

Mon Aug 17, 2009 6:48 am

Hi

About 1 month ago I tried to configure the MKT like VPN Client but I couldn't do because Cisco ASA use other options like (group, user and password) so I couldn't found how to do it?.

When I do only the IPSec connection (MKT to ASA) works fine but the trouble begins when ASA uses (group, user and pass). So if anybody know it,please tell us how did you do it? :D

Best regard.
 
thadem
Member Candidate
Member Candidate
Posts: 115
Joined: Fri Apr 18, 2008 1:40 am

Re: Mikrotik as cisco VPN client

Mon Aug 17, 2009 2:39 pm

i think you are referring to XAUTH, which is afaik not supported on mikrotik ros.
so at least at the moment your only choice is a plain ipsec-connection.
 
User avatar
mushmx
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Sat Jul 21, 2007 7:01 pm
Location: Mexico

Re: Mikrotik as cisco VPN client

Mon Aug 17, 2009 8:30 pm

i think you are referring to XAUTH, which is afaik not supported on mikrotik ros.
so at least at the moment your only choice is a plain ipsec-connection.
Ok. Actually I have a plain IPSec connection.

Thanks. 8)
 
santajosh
Frequent Visitor
Frequent Visitor
Posts: 69
Joined: Fri Dec 09, 2005 3:20 pm

Re: Mikrotik as cisco VPN client

Wed Jan 27, 2010 11:29 am

Hi EveryOne!

Is there a chance to use this kind of VPN with Mikrotik OS, new version 4.x? I'm also have to create (dvpn) vpn to cisco with Xauth username on a Mikrotik OS.


Thanks in advice.

Josh
 
gregsowell
Member Candidate
Member Candidate
Posts: 128
Joined: Tue Aug 28, 2007 1:24 am
Contact:

Re: Mikrotik as cisco VPN client

Fri Jan 29, 2010 9:59 pm

Hi guys!

I've got slides and a video tutorial on Mikrotik VPN. It includes MTK to Cisco and even shows you how to configure your ASA for the tunnel.

http://gregsowell.com/?p=1290

I hope this helps :)
Hit my blog for video tutorials of Mikrotik and Cacti.
Just so I look as cool as everyone else ->CCNA / CCNP / CCIE W / MCNA / MCRE / MCIE / Certified Trainer / A+ / N+ / Partridge in pear tree <- *sigh* I'll never know enough...
 
frankar
just joined
Posts: 1
Joined: Sat Jul 10, 2010 12:28 pm

Re: Mikrotik as cisco VPN client

Sat Jul 10, 2010 12:41 pm

Hi guys!

About http://wiki.mikrotik.com/wiki/MikroTik_ ... wall_IPSEC

- in the ip ipsec policy, I thinlk
src-address
and
dst-address
are inverted
-in the last firewall rule
ip firewall add
, must be:
ip firewall filter add
or
ip firewall nat add
?
- in the last firewall rule I read:
chain=customer
but I have not this rule defined

Thanks for your reply
Franco
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24493
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Mikrotik as cisco VPN client

Mon Jul 12, 2010 9:34 am

That article is written by a forum user, it's not a MikroTik article. You have the ability to change it. I can't vouch for it's accuracy.

MikroTik articles are marked with category "manual"
No answer to your question? How to write posts
 
mknos
just joined
Posts: 22
Joined: Fri Mar 19, 2010 4:49 pm

Re: Mikrotik as cisco VPN client

Sun Jul 18, 2010 7:49 am

I've got a laptop dedicated to running vpnc as that's the only thing I can't do on mikrotik. I can't configure the other end so I'm stuck with running vpnc.

Would it be possible for me to cross compile vpnc and get it running on my RB433?
 
fewi
Forum Guru
Forum Guru
Posts: 7734
Joined: Tue Aug 11, 2009 3:19 am

Re: Mikrotik as cisco VPN client

Sun Jul 18, 2010 7:57 am

No. You cannot put custom code on RouterOS.
 
mknos
just joined
Posts: 22
Joined: Fri Mar 19, 2010 4:49 pm

Re: Mikrotik as cisco VPN client

Mon Jul 19, 2010 9:05 am

No. You cannot put custom code on RouterOS.
Er, doesn't RouterOS have a linux based kernel? If so, why is it not possible to put custom code on it?
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24493
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Mikrotik as cisco VPN client

Mon Jul 19, 2010 9:08 am

because it's routeros. if you want custom code, there are many distributions for that.

RouterOS is organized in a certain way, and it's got tech support. When you start modifying it, it becomes just like anything else.
No answer to your question? How to write posts
 
mknos
just joined
Posts: 22
Joined: Fri Mar 19, 2010 4:49 pm

Re: Mikrotik as cisco VPN client

Mon Jul 19, 2010 10:05 am

Suppose I don't mind losing tech support? Can I download the linux and other GPL sources and modify my build?

If I get vpnc working I'd be happy to contribute the information to the wiki or to MikroTik. From a quick search, there appear to be quite a few people who would like to get vpnc working on RouterOS.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24493
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Mikrotik as cisco VPN client

Mon Jul 19, 2010 10:17 am

read the license

I don't see why you would do this, as there are free distributions which are easier to modify, and for which there is large community support. here - nobody will help you
No answer to your question? How to write posts
 
mknos
just joined
Posts: 22
Joined: Fri Mar 19, 2010 4:49 pm

Re: Mikrotik as cisco VPN client

Mon Jul 19, 2010 11:49 am

The reason I bought a RouterBoard was because I was fed up of installing linux distributions and endlessly configuring them, so I've been trying to replace everything with RouterOS. It's about 38C in my office and I'm trying to switch off as many things as I can. If I could know one more laptop off that purely exists to run vpnc then I'd be more than happy in doing the work to get rid of it. I'm not interested in OpenWRT or whatever, if I were, I'd have stuck with my linux gateways.
That's all...
 
mknos
just joined
Posts: 22
Joined: Fri Mar 19, 2010 4:49 pm

Re: Mikrotik as cisco VPN client

Fri Jul 30, 2010 4:58 pm

Solved! (well sort of).

Thanks to a suggestion from elsewhere, I've just created a metarouter VM within which I can run vpnc.
 
mknos
just joined
Posts: 22
Joined: Fri Mar 19, 2010 4:49 pm

Re: Mikrotik as cisco VPN client

Mon Aug 30, 2010 9:43 am

Finally got round to actually doing this. For anyone else who needs to run vpnc, here's what I did:

Follow the instructions here: http://wiki.mikrotik.com/wiki/Manual:Metarouter importing the openwrt
image into the metarouter. Get a copy of vpnc and the tun.ko kernel module. I compiled
them which was a bit of a hassle, but ended up with these if you want to avoid the effort (and
you trust a complete stranger to compile them for you...):
http://www.sbrk.co.uk/vpnc
http://www.sbrk.co.uk/tun.ko

openwrt has a package system called opkg which allows you to point to various repositories for
new packages, but I couldn't figure out where to point it. I'm sure there is somewhere with
these.

After insmod ./tun.ko, ./vpnc works with my imported configuration leaving the only issue to
set up networking. I bridged the openwrt metarouter and configured a route to the network
used by vpnc, set up nat on the tun0 interface in openwrt and allowed forwarding and all
is working.

There is one issue remaining in that if I reboot my rb, the bridge ports disappear, presumably
because they don't exist until the metarouter vm starts. So, I have to go in and configure them
again after a reboot.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24493
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Mikrotik as cisco VPN client

Mon Aug 30, 2010 9:49 am

great! I knew RouterOS would be able to help you in some way :) sorry for not recommending metarouter any sooner
No answer to your question? How to write posts
 
seb
just joined
Posts: 3
Joined: Sat Nov 05, 2011 7:36 pm

Re: Mikrotik as cisco VPN client

Sat Nov 05, 2011 7:47 pm

Hey Mknos, thanks for the basics for a vpnc solution. I have most of it working, but I'm not sure how to set up NAT on openwrt. Can you supply details on that?
 
ivissie
just joined
Posts: 1
Joined: Thu Jan 15, 2015 4:06 pm

Re: Mikrotik as cisco VPN client

Thu Jan 15, 2015 4:27 pm

Hi all,

I have successfully got mine working as well.

The metarouter image I used is: http://openwrt.wk.cz/attitude_adjustmen ... tfs.tar.gz

Configure your network interface by using "uci"
  • Show network configutations: "uci show network"
  • Show all configurations: "uci show"
[*]Set configuration: "uci set network.wan=interface"

Mine looks as follow:
network.wan.proto=static
network.wan.ipaddr=172.16.2.6
network.wan.netmask=255.255.255.252
network.wan.ifname=eth0
network.wan.gateway=172.16.2.5
network.wan.dns=172.16.2.5
network.lan=interface
network.lan.proto=static
network.lan.ipaddr=172.16.2.2
network.lan.netmask=255.255.255.252
network.lan.ifname=eth1
Where my WAN interface are used to get internet to the image and the lan will be used to access the VPN connection.
After configuring the network settings you need to commit them and restart the network service.
Run the following commands:
  • uci commit network
  • /etc/init.d/network restart
For some reason the dns nameserver does not take affect and you need to modify it manually at /etc/resolve.conf and enter your dns server details, otherwise you will not be able to update and download the packages needed.


Then you can install vpnc by following the tutorial here: http://wiki.openwrt.org/vpnc.vpn
  • In the file created /etc/init.d/vpnc file. remove the spaces in the first few lines between the START=75 and STOP=01. It does not work with the spaces. Unable to find start/stop on line 2 and line 3 error.
  • At the steps when you try to run "/etc/init.d/vpnc enable" you get an error, first enable the file to be executable by running "chmod +x /etc/init.d/vpnc" and then you will be able to enable the automatic boot script.
  • IP Tables - This one I have not figured out yet. When the metarouter restarts the IPtables are missing and you need to reapply them.
You connect the VPN by either running the startup script or the vpnc client itself.
vpnc
or
/etc/init.d/vpnc start

You can then see that the tunnel is up by using ifconfig
root@metarouter:/# ifconfig
eth0 Link encap:Ethernet HWaddr 02:0B:3E:55:A6:23
inet addr:172.16.2.6 Bcast:172.16.2.7 Mask:255.255.255.252
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2517 errors:0 dropped:0 overruns:0 frame:0
TX packets:2039 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:888004 (867.1 KiB) TX bytes:364073 (355.5 KiB)

eth1 Link encap:Ethernet HWaddr 02:5B:39:4F:B5:12
inet addr:172.16.2.2 Bcast:172.16.2.3 Mask:255.255.255.252
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4787 errors:0 dropped:0 overruns:0 frame:0
TX packets:2992 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:447771 (437.2 KiB) TX bytes:679876 (663.9 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2748 errors:0 dropped:0 overruns:0 frame:0
TX packets:2748 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:186756 (182.3 KiB) TX bytes:186756 (182.3 KiB)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.102.253.87 P-t-P:10.102.253.87 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1412 Metric:1
RX packets:41 errors:0 dropped:0 overruns:0 frame:0
TX packets:432 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:4428 (4.3 KiB) TX bytes:31605 (30.8 KiB)
On your route make sure that you route the ip ranges you need and masquerade it as required.

Traceroute from PC going to my gateway ( mikrotik) over to metarouter into the VPN.
C:\Users\Administrator>tracert -d 10.117.12.117

Tracing route to 10.117.12.117 over a maximum of 30 hops

1 <1 ms <1 ms 1 ms 10.20.0.254
2 2 ms 1 ms 1 ms 172.16.2.2
3 142 ms 36 ms 26 ms 10.102.250.2
4 213 ms 43 ms 37 ms 10.101.255.73
5 137 ms 24 ms 23 ms 10.101.255.206
6 114 ms 27 ms 26 ms 10.103.82.5
7 70 ms 201 ms 215 ms 10.251.201.0
Success.

Thank you for the tip of using metarouter and vpnc!
 
Shatura
just joined
Posts: 1
Joined: Tue Mar 17, 2015 7:30 pm

Re: Mikrotik as cisco VPN client

Tue Mar 17, 2015 8:07 pm

I tried metarouter image http://openwrt.wk.cz/attitude_adjustmen ... tfs.tar.gz as well. And it even works. Several minutes or maybe hours. Then metarouter freezes. The only option you have is to reboot metarouter. While rebooting it makes the host router to reboot as well. Very annoying. And even when it works it loses 20% of bandwidth comparing to Windows Cisco client.

Then I tried the routine http://cases.azoft.com/how-to-connect-m ... cisco-vpn/ with Mikrotik-recommended image http://www.mikrotik.com/download/metaro ... rootfs.tgz and vpnc from http://rnd.rajven.net/openwrt/mikrotik/ ... s/packages repository. This client connects to my corporate Cisco successfully and even makes appropriate routes to my internal networks. But I could not manage to get any traffic through these routes whatsoever. No ping, no telnet, no DNS request. And no errors and no warnings.

I wasted two days trying to make good usage of metarouter vpnc. Eventually I took a cheap spare router and installed DD-WRT there with vpnc. Vpnc works with two different Ciscos on my two remote jobs and provides me with two remote internal networks simultaneously. The only thing Mikrotik has to do with this it routes appropriate requests from my home network to remote networks through internal address of the second router. Works like a charm.

Who is online

Users browsing this forum: Steveocee, uamma and 45 guests