Community discussions

MikroTik App
  4. RouterOS
  5. General

IPsec over L2TP (Client-VPN) not starting anymore  [SOLVED]

Post Reply
 
User avatar
florianmulatz
newbie
Topic Author
Posts: 47
Joined: Mon Sep 16, 2013 5:02 pm
Location: Klagenfurt am Woerthersee / Austria

IPsec over L2TP (Client-VPN) not starting anymore

Thu May 23, 2024 11:06 am

Hi Everyone,

I’m wondering if you can help me figure out why my IPsec over L2TP VPN stopped working since yesterday (no changes were made on the MikroTik). (The VPN tunnel works fine from a Windows VPN client.)

The VPN server is a Cisco Meraki firewall (which the service provider also said was not changed) to which I do not have access (managed by the service provider). My client device is a RB-3011UiAS.

Config on my Mikrotik:
Code: Select all
[admin@router-main] /interface/l2tp-client> print 
Flags: X - disabled; R - running 
 0   name="wid-client-vpn" max-mtu=1450 max-mru=1450 mrru=disabled connect-to=81.999.185.158 user="contoso\vpn-user" password="1234567890" profile=WID 
      keepalive-timeout=60 use-peer-dns=no use-ipsec=yes ipsec-secret="f5"j3HGV:oWTAgm" allow-fast-path=yes add-default-route=no dial-on-demand=yes allow=pap 
      l2tp-proto-version=l2tpv2 l2tpv3-digest-hash=md5 

[admin@router-main] /interface/l2tp-client> /ppp/profile/print 
Flags: * - default 
 1   name="WID" bridge-learning=default use-ipv6=no use-mpls=no use-compression=yes use-encryption=required only-one=yes change-tcp-mss=no use-upnp=no address-list="" 
     on-up=/ip route add dst-address=10.0.207.0/24 gateway=wid-client-vpn\r\n on-down=/ip route remove [find dst-address=10.0.207.0/24]\r\n 

[admin@router-main] /interface/l2tp-client> /ip/ipsec/profile/print 
Flags: * - default 
 0 * name="default" hash-algorithm=sha1 enc-algorithm=aes-256,aes-128,3des dh-group=modp2048,modp1024 lifetime=8h proposal-check=obey nat-traversal=yes dpd-interval=2m 
     dpd-maximum-failures=5
I've obfuscated the public IPs in the logoutput. The logoutput ran about 1min until i disabled the interface again since it was still showing "waiting on packets ..."

Thx for any help indeed!
Code: Select all
09:55:26 l2tp,ppp,debug wid-client-vpn: IPCP demandUp
 09:55:26 l2tp,ppp,debug wid-client-vpn: IPV6CP demandUp
 09:55:28 ipsec,debug 0.0.0.0[500] used as isakmp port (fd=10)
 09:55:28 ipsec,debug 0.0.0.0[4500] used as isakmp port with NAT-T (fd=12)
 09:55:28 ipsec,debug ::[500] used as isakmp port (fd=13)
 09:55:28 ipsec,debug ::[4500] used as isakmp port (fd=14)
 09:55:28 l2tp,debug tunnel 35 entering state: wait-ctl-reply
 09:55:28 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:28 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:28 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:28 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:28 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:28 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:28 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:28 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:28 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:28 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:23
 09:55:28 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:55:28 ipsec,debug  (proto_id=ESP spisize=4 spi=00000000 spi_p=00000000 encmode=Transport reqid=0:0)
 09:55:28 ipsec,debug   (trns_id=AES-CBC encklen=128 authtype=hmac-sha1)
 09:55:28 ipsec,debug ===
 09:55:28 ipsec,debug new cookie:
 09:55:28 ipsec,debug 378291ab1ceea724
 09:55:28 ipsec,debug add payload of len 224, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 13
 09:55:28 ipsec,debug add payload of len 16, next type 0
 09:55:28 ipsec,debug 516 bytes from 80.109.999.132[500] to 81.999.185.158[500]
 09:55:28 ipsec,debug 1 times of 516 bytes message will be sent to 81.999.185.158[500]
 09:55:28 ipsec,debug,packet 378291ab 1ceea724 00000000 00000000 01100200 00000000 00000204 0d0000e4
 09:55:28 ipsec,debug,packet 00000001 00000001 000000d8 01010006 03000024 01010000 800b0001 800c7080
 09:55:28 ipsec,debug,packet 80010007 800e0100 80030001 80020002 8004000e 03000024 02010000 800b0001
 09:55:28 ipsec,debug,packet 800c7080 80010007 800e0100 80030001 80020002 80040002 03000024 03010000
 09:55:28 ipsec,debug,packet 800b0001 800c7080 80010007 800e0080 80030001 80020002 8004000e 03000024
 09:55:28 ipsec,debug,packet 04010000 800b0001 800c7080 80010007 800e0080 80030001 80020002 80040002
 09:55:28 ipsec,debug,packet 03000020 05010000 800b0001 800c7080 80010005 80030001 80020002 8004000e
 09:55:28 ipsec,debug,packet 00000020 06010000 800b0001 800c7080 80010005 80030001 80020002 80040002
 09:55:28 ipsec,debug,packet 0d000014 4a131c81 07035845 5c5728f2 0e95452f 0d000014 8f8d8382 6d246b6f
 09:55:28 ipsec,debug,packet c7a8a6a4 28c11de8 0d000014 439b59f8 ba676c4c 7737ae22 eab8f582 0d000014
 09:55:28 ipsec,debug,packet 4d1e0e13 6deafa34 c4f3ea9f 02ec7285 0d000014 80d0bb3d ef54565e e84645d4
 09:55:28 ipsec,debug,packet c85ce3ee 0d000014 9909b64e ed937c65 73de52ac e952fa6b 0d000014 7d9419a6
 09:55:28 ipsec,debug,packet 5310ca6f 2c179d92 15529d56 0d000014 cd604643 35df21f8 7cfdb2fc 68b6a448
 09:55:28 ipsec,debug,packet 0d000014 90cb8091 3ebb696e 086381b5 ec427b1f 0d000014 16f6ca16 e4a4066d
 09:55:28 ipsec,debug,packet 83821a0f 0aeaa862 0d000014 4485152d 18b6bbcd 0be8a846 9579ddcc 0d000014
 09:55:28 ipsec,debug,packet 12f5f28c 457168a9 702d9fe2 74cc0100 00000014 afcad713 68a1f1c9 6b8696fc
 09:55:28 ipsec,debug,packet 77570100
 09:55:28 ipsec,debug ===== received 132 bytes from 81.999.185.158[500] to 80.109.999.132[500]
 09:55:28 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 01100200 00000000 00000084 0d000034
 09:55:28 ipsec,debug,packet 00000001 00000001 00000028 01010001 00000020 06010000 80010005 80020002
 09:55:28 ipsec,debug,packet 80040002 80030001 800b0001 800c7080 0d00000c 09002689 dfd6b712 0d000014
 09:55:28 ipsec,debug,packet afcad713 68a1f1c9 6b8696fc 77570100 00000014 4a131c81 07035845 5c5728f2
 09:55:28 ipsec,debug,packet 0e95452f
 09:55:28 ipsec,debug begin.
 09:55:28 ipsec,debug seen nptype=1(sa) len=52
 09:55:28 ipsec,debug seen nptype=13(vid) len=12
 09:55:28 ipsec,debug seen nptype=13(vid) len=20
 09:55:28 ipsec,debug seen nptype=13(vid) len=20
 09:55:28 ipsec,debug succeed.
 09:55:28 ipsec,debug remote supports DPD
 09:55:28 ipsec,debug total SA len=48
 09:55:28 ipsec,debug 00000001 00000001 00000028 01010001 00000020 06010000 80010005 80020002
 09:55:28 ipsec,debug 80040002 80030001 800b0001 800c7080
 09:55:28 ipsec,debug begin.
 09:55:28 ipsec,debug seen nptype=2(prop) len=40
 09:55:28 ipsec,debug succeed.
 09:55:28 ipsec,debug proposal #1 len=40
 09:55:28 ipsec,debug begin.
 09:55:28 ipsec,debug seen nptype=3(trns) len=32
 09:55:28 ipsec,debug succeed.
 09:55:28 ipsec,debug transform #6 len=32
 09:55:28 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=3DES-CBC
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
 09:55:28 ipsec,debug hash(sha1)
 09:55:28 ipsec,debug type=Group Description, flag=0x8000, lorv=1024-bit MODP group
 09:55:28 ipsec,debug dh(modp1024)
 09:55:28 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
 09:55:28 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
 09:55:28 ipsec,debug type=Life Duration, flag=0x8000, lorv=28800
 09:55:28 ipsec,debug pair 1:
 09:55:28 ipsec,debug  0x9fbe0: next=0 tnext=0
 09:55:28 ipsec,debug proposal #1: 1 transform
 09:55:28 ipsec,debug -checking with pre-shared key auth-
 09:55:28 ipsec,debug prop#=1, prot-id=ISAKMP, spi-size=0, #trns=1
 09:55:28 ipsec,debug trns#=6, trns-id=IKE
 09:55:28 ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=3DES-CBC
 09:55:28 ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
 09:55:28 ipsec,debug type=Group Description, flag=0x8000, lorv=1024-bit MODP group
 09:55:28 ipsec,debug type=Authentication Method, flag=0x8000, lorv=pre-shared key
 09:55:28 ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
 09:55:28 ipsec,debug type=Life Duration, flag=0x8000, lorv=28800
 09:55:28 ipsec,debug -compare proposal #1: Local:Peer
 09:55:28 ipsec,debug (lifetime = 28800:28800)
 09:55:28 ipsec,debug (lifebyte = 0:0)
 09:55:28 ipsec,debug enctype = AES-CBC:3DES-CBC
 09:55:28 ipsec,debug (encklen = 256:0)
 09:55:28 ipsec,debug hashtype = SHA:SHA
 09:55:28 ipsec,debug authmethod = pre-shared key:pre-shared key
 09:55:28 ipsec,debug dh_group = 2048-bit MODP group:1024-bit MODP group
 09:55:28 ipsec,debug -compare proposal #2: Local:Peer
 09:55:28 ipsec,debug (lifetime = 28800:28800)
 09:55:28 ipsec,debug (lifebyte = 0:0)
 09:55:28 ipsec,debug enctype = AES-CBC:3DES-CBC
 09:55:28 ipsec,debug (encklen = 256:0)
 09:55:28 ipsec,debug hashtype = SHA:SHA
 09:55:28 ipsec,debug authmethod = pre-shared key:pre-shared key
 09:55:28 ipsec,debug dh_group = 1024-bit MODP group:1024-bit MODP group
 09:55:28 ipsec,debug -compare proposal #3: Local:Peer
 09:55:28 ipsec,debug (lifetime = 28800:28800)
 09:55:28 ipsec,debug (lifebyte = 0:0)
 09:55:28 ipsec,debug enctype = AES-CBC:3DES-CBC
 09:55:28 ipsec,debug (encklen = 128:0)
 09:55:28 ipsec,debug hashtype = SHA:SHA
 09:55:28 ipsec,debug authmethod = pre-shared key:pre-shared key
 09:55:28 ipsec,debug dh_group = 2048-bit MODP group:1024-bit MODP group
 09:55:28 ipsec,debug -compare proposal #4: Local:Peer
 09:55:28 ipsec,debug (lifetime = 28800:28800)
 09:55:28 ipsec,debug (lifebyte = 0:0)
 09:55:28 ipsec,debug enctype = AES-CBC:3DES-CBC
 09:55:28 ipsec,debug (encklen = 128:0)
 09:55:28 ipsec,debug hashtype = SHA:SHA
 09:55:28 ipsec,debug authmethod = pre-shared key:pre-shared key
 09:55:28 ipsec,debug dh_group = 1024-bit MODP group:1024-bit MODP group
 09:55:28 ipsec,debug -compare proposal #5: Local:Peer
 09:55:28 ipsec,debug (lifetime = 28800:28800)
 09:55:28 ipsec,debug (lifebyte = 0:0)
 09:55:28 ipsec,debug enctype = 3DES-CBC:3DES-CBC
 09:55:28 ipsec,debug (encklen = 0:0)
 09:55:28 ipsec,debug hashtype = SHA:SHA
 09:55:28 ipsec,debug authmethod = pre-shared key:pre-shared key
 09:55:28 ipsec,debug dh_group = 2048-bit MODP group:1024-bit MODP group
 09:55:28 ipsec,debug -compare proposal #6: Local:Peer
 09:55:28 ipsec,debug (lifetime = 28800:28800)
 09:55:28 ipsec,debug (lifebyte = 0:0)
 09:55:28 ipsec,debug enctype = 3DES-CBC:3DES-CBC
 09:55:28 ipsec,debug (encklen = 0:0)
 09:55:28 ipsec,debug hashtype = SHA:SHA
 09:55:28 ipsec,debug authmethod = pre-shared key:pre-shared key
 09:55:28 ipsec,debug dh_group = 1024-bit MODP group:1024-bit MODP group
 09:55:28 ipsec,debug -an acceptable proposal found-
 09:55:28 ipsec,debug -agreed on pre-shared key auth-
 09:55:28 ipsec,debug ===
 09:55:28 ipsec,debug,packet compute DH's public.
 09:55:28 ipsec,debug,packet d3f9a599 c042c32a 298018ff 9af63bb8 9a91dc27 33a3bac5 9e2316bc 673dc002
 09:55:28 ipsec,debug,packet 77c7be49 09d2bf3e fcea0e36 64e0ef85 2b65f2fe 84826fc0 fcc19efa 7edcd62b
 09:55:28 ipsec,debug,packet 070addf5 584d85d1 ed54d389 ac9dba35 dcfe429b 912752f1 3e83cf38 ad2c7cc7
 09:55:28 ipsec,debug,packet c067d7a6 f19a35f0 8755be0e 3b840900 f35dfa05 adc4c8e4 089872c9 914cb281
 09:55:28 ipsec,debug 81.999.185.158 Hashing 81.999.185.158[500] with algo #2 
 09:55:28 ipsec,debug hash(sha1)
 09:55:28 ipsec,debug 80.109.999.132 Hashing 80.109.999.132[500] with algo #2 
 09:55:28 ipsec,debug hash(sha1)
 09:55:28 ipsec,debug add payload of len 128, next type 10
 09:55:28 ipsec,debug add payload of len 24, next type 20
 09:55:28 ipsec,debug add payload of len 20, next type 20
 09:55:28 ipsec,debug add payload of len 20, next type 0
 09:55:28 ipsec,debug 236 bytes from 80.109.999.132[500] to 81.999.185.158[500]
 09:55:28 ipsec,debug 1 times of 236 bytes message will be sent to 81.999.185.158[500]
 09:55:28 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 04100200 00000000 000000ec 0a000084
 09:55:28 ipsec,debug,packet d3f9a599 c042c32a 298018ff 9af63bb8 9a91dc27 33a3bac5 9e2316bc 673dc002
 09:55:28 ipsec,debug,packet 77c7be49 09d2bf3e fcea0e36 64e0ef85 2b65f2fe 84826fc0 fcc19efa 7edcd62b
 09:55:28 ipsec,debug,packet 070addf5 584d85d1 ed54d389 ac9dba35 dcfe429b 912752f1 3e83cf38 ad2c7cc7
 09:55:28 ipsec,debug,packet c067d7a6 f19a35f0 8755be0e 3b840900 f35dfa05 adc4c8e4 089872c9 914cb281
 09:55:28 ipsec,debug,packet 1400001c e4cf778c 4ca3b177 493f549a 0d95ab4e 078fe63b 3408c977 14000018
 09:55:28 ipsec,debug,packet 521d9389 8180892b b916dce3 b0a972dc bb00ecf1 00000018 3f597eea 867951d6
 09:55:28 ipsec,debug,packet 75ebd828 6c752944 1fb8a1f1
 09:55:28 ipsec,debug ===== received 244 bytes from 81.999.185.158[500] to 80.109.999.132[500]
 09:55:28 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 04100200 00000000 000000f4 0a000084
 09:55:28 ipsec,debug,packet 04f38f66 f197fffa 9c2a4105 5a80d996 338eb22d 1b431734 ffebedc1 c3658708
 09:55:28 ipsec,debug,packet ad41dde0 9d40baca 3f31e704 ba9fc870 b6e458c9 ece2bc93 a212e89d badd648a
 09:55:28 ipsec,debug,packet eac2e4eb b85bbd0e a3807c00 92f6aa9e 7699a936 3d952f4a 916fb4ca 3c20ba9c
 09:55:28 ipsec,debug,packet 21a83bb3 d48c5ced aa4efbbf e25aa0fb d0af37f1 fdbf8507 6df43751 d2e61f04
 09:55:28 ipsec,debug,packet 14000024 6d8858b9 2b17a546 b383d979 9f527dd6 32a996ec ff211256 0133ad39
 09:55:28 ipsec,debug,packet 1e0f9607 14000018 3f597eea 867951d6 75ebd828 6c752944 1fb8a1f1 00000018
 09:55:28 ipsec,debug,packet 521d9389 8180892b b916dce3 b0a972dc bb00ecf1
 09:55:28 ipsec,debug begin.
 09:55:28 ipsec,debug seen nptype=4(ke) len=132
 09:55:28 ipsec,debug seen nptype=10(nonce) len=36
 09:55:28 ipsec,debug seen nptype=20(nat-d) len=24
 09:55:28 ipsec,debug seen nptype=20(nat-d) len=24
 09:55:28 ipsec,debug succeed.
 09:55:28 ipsec,debug 80.109.999.132 Hashing 80.109.999.132[500] with algo #2 
 09:55:28 ipsec,debug hash(sha1)
 09:55:28 ipsec,debug NAT-D payload #0 verified
 09:55:28 ipsec,debug 81.999.185.158 Hashing 81.999.185.158[500] with algo #2 
 09:55:28 ipsec,debug hash(sha1)
 09:55:28 ipsec,debug NAT-D payload #1 verified
 09:55:28 ipsec,debug ===
 09:55:28 ipsec,debug => shared secret (size 0x80)
 09:55:28 ipsec,debug 8de4fa2f c9edd800 4a85403d 9ae5c0c2 19f729bb 6c0c80a0 180a7b4a 6ad93f3a
 09:55:28 ipsec,debug e94d0e8c ef69b895 e91013b0 9b7bbdf2 3f54b1c0 7e04284c fd32eb75 3a18d4a0
 09:55:28 ipsec,debug bd373959 70c4bc96 6a667134 79d4d77a 551f19d0 df2964c9 9c0f5ba5 aea4b78f
 09:55:28 ipsec,debug 563c0816 47d45583 9d4d9dd1 3b53dd1d efad6939 753b2b9f cc32dabb 57ed6d60
 09:55:28 ipsec,debug,packet compute DH's shared.
 09:55:28 ipsec,debug,packet 
 09:55:28 ipsec,debug,packet 8de4fa2f c9edd800 4a85403d 9ae5c0c2 19f729bb 6c0c80a0 180a7b4a 6ad93f3a
 09:55:28 ipsec,debug,packet e94d0e8c ef69b895 e91013b0 9b7bbdf2 3f54b1c0 7e04284c fd32eb75 3a18d4a0
 09:55:28 ipsec,debug,packet bd373959 70c4bc96 6a667134 79d4d77a 551f19d0 df2964c9 9c0f5ba5 aea4b78f
 09:55:28 ipsec,debug,packet 563c0816 47d45583 9d4d9dd1 3b53dd1d efad6939 753b2b9f cc32dabb 57ed6d60
 09:55:28 ipsec,debug nonce 1: 
 09:55:28 ipsec,debug e4cf778c 4ca3b177 493f549a 0d95ab4e 078fe63b 3408c977
 09:55:28 ipsec,debug nonce 2: 
 09:55:28 ipsec,debug 6d8858b9 2b17a546 b383d979 9f527dd6 32a996ec ff211256 0133ad39 1e0f9607
 09:55:28 ipsec,debug,packet hmac(hmac_sha1)
 09:55:28 ipsec,debug SKEYID computed:
 09:55:28 ipsec,debug fdbb44a5 feac06ac 216ed30d 87cc4e3f f1e1dab0
 09:55:28 ipsec,debug,packet hmac(hmac_sha1)
 09:55:28 ipsec,debug SKEYID_d computed:
 09:55:28 ipsec,debug 02907598 c26c3093 60f3ceb7 f18bd661 d546ae8f
 09:55:28 ipsec,debug,packet hmac(hmac_sha1)
 09:55:28 ipsec,debug SKEYID_a computed:
 09:55:28 ipsec,debug 8fe1fe01 fd3a9586 d70c53f7 0a72a5dc 5c1d3aa7
 09:55:28 ipsec,debug,packet hmac(hmac_sha1)
 09:55:28 ipsec,debug SKEYID_e computed:
 09:55:28 ipsec,debug 6ba0a46f 00230e30 f9a08ce9 fd2813b9 f3015034
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug hash(sha1)
 09:55:28 ipsec,debug len(SKEYID_e) < len(Ka) (20 < 24), generating long key (Ka = K1 | K2 | ...)
 09:55:28 ipsec,debug,packet hmac(hmac_sha1)
 09:55:28 ipsec,debug compute intermediate encryption key K1
 09:55:28 ipsec,debug 00
 09:55:28 ipsec,debug 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91
 09:55:28 ipsec,debug,packet hmac(hmac_sha1)
 09:55:28 ipsec,debug compute intermediate encryption key K2
 09:55:28 ipsec,debug 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91
 09:55:28 ipsec,debug 6f318097 6304bd09 0de82f1c a2ebe09c ac42ce4d
 09:55:28 ipsec,debug final encryption key computed:
 09:55:28 ipsec,debug 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91 6f318097
 09:55:28 ipsec,debug hash(sha1)
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug IV computed:
 09:55:28 ipsec,debug 51163d66 e6696788
 09:55:28 ipsec,debug use ID type of IPv4_address
 09:55:28 ipsec,debug,packet HASH with:
 09:55:28 ipsec,debug,packet d3f9a599 c042c32a 298018ff 9af63bb8 9a91dc27 33a3bac5 9e2316bc 673dc002
 09:55:28 ipsec,debug,packet 77c7be49 09d2bf3e fcea0e36 64e0ef85 2b65f2fe 84826fc0 fcc19efa 7edcd62b
 09:55:28 ipsec,debug,packet 070addf5 584d85d1 ed54d389 ac9dba35 dcfe429b 912752f1 3e83cf38 ad2c7cc7
 09:55:28 ipsec,debug,packet c067d7a6 f19a35f0 8755be0e 3b840900 f35dfa05 adc4c8e4 089872c9 914cb281
 09:55:28 ipsec,debug,packet 04f38f66 f197fffa 9c2a4105 5a80d996 338eb22d 1b431734 ffebedc1 c3658708
 09:55:28 ipsec,debug,packet ad41dde0 9d40baca 3f31e704 ba9fc870 b6e458c9 ece2bc93 a212e89d badd648a
 09:55:28 ipsec,debug,packet eac2e4eb b85bbd0e a3807c00 92f6aa9e 7699a936 3d952f4a 916fb4ca 3c20ba9c
 09:55:28 ipsec,debug,packet 21a83bb3 d48c5ced aa4efbbf e25aa0fb d0af37f1 fdbf8507 6df43751 d2e61f04
 09:55:28 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 00000001 00000001 000000d8 01010006
 09:55:28 ipsec,debug,packet 03000024 01010000 800b0001 800c7080 80010007 800e0100 80030001 80020002
 09:55:28 ipsec,debug,packet 8004000e 03000024 02010000 800b0001 800c7080 80010007 800e0100 80030001
 09:55:28 ipsec,debug,packet 80020002 80040002 03000024 03010000 800b0001 800c7080 80010007 800e0080
 09:55:28 ipsec,debug,packet 80030001 80020002 8004000e 03000024 04010000 800b0001 800c7080 80010007
 09:55:28 ipsec,debug,packet 800e0080 80030001 80020002 80040002 03000020 05010000 800b0001 800c7080
 09:55:28 ipsec,debug,packet 80010005 80030001 80020002 8004000e 00000020 06010000 800b0001 800c7080
 09:55:28 ipsec,debug,packet 80010005 80030001 80020002 80040002 011101f4 506de584
 09:55:28 ipsec,debug,packet hmac(hmac_sha1)
 09:55:28 ipsec,debug,packet HASH computed:
 09:55:28 ipsec,debug,packet a6943aa3 e96baf9b 6873eaa3 74877cd3 02329386
 09:55:28 ipsec,debug add payload of len 8, next type 8
 09:55:28 ipsec,debug add payload of len 20, next type 0
 09:55:28 ipsec,debug,packet begin encryption.
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug,packet pad length = 4
 09:55:28 ipsec,debug,packet 0800000c 011101f4 506de584 00000018 a6943aa3 e96baf9b 6873eaa3 74877cd3
 09:55:28 ipsec,debug,packet 02329386 fab96003
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug,packet with key:
 09:55:28 ipsec,debug,packet 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91 6f318097
 09:55:28 ipsec,debug,packet encrypted payload by IV:
 09:55:28 ipsec,debug,packet 51163d66 e6696788
 09:55:28 ipsec,debug,packet save IV for next:
 09:55:28 ipsec,debug,packet 8bc2a84b ad5ada51
 09:55:28 ipsec,debug,packet encrypted.
 09:55:28 ipsec,debug 68 bytes from 80.109.999.132[500] to 81.999.185.158[500]
 09:55:28 ipsec,debug 1 times of 68 bytes message will be sent to 81.999.185.158[500]
 09:55:28 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 05100201 00000000 00000044 2ddb4ec5
 09:55:28 ipsec,debug,packet 06d479bd d8f603b8 27acfa11 dd1104a0 9a2936ac ed81108d 1689296d 8bc2a84b
 09:55:28 ipsec,debug,packet ad5ada51
 09:55:28 ipsec,debug ===== received 68 bytes from 81.999.185.158[500] to 80.109.999.132[500]
 09:55:28 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 05100201 00000000 00000044 e8b2e951
 09:55:28 ipsec,debug,packet 467f7e17 087b9c6b e8e8292d 92906bd1 3837ca31 d36d3712 73804981 2eaf0b76
 09:55:28 ipsec,debug,packet ca6da732
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug,packet IV was saved for next processing:
 09:55:28 ipsec,debug,packet 2eaf0b76 ca6da732
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug,packet with key:
 09:55:28 ipsec,debug,packet 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91 6f318097
 09:55:28 ipsec,debug,packet decrypted payload by IV:
 09:55:28 ipsec,debug,packet 8bc2a84b ad5ada51
 09:55:28 ipsec,debug,packet decrypted payload, but not trimed.
 09:55:28 ipsec,debug,packet 0800000c 01000000 51dfb99e 00000018 46b7e5b2 ed677dcd 553ca1bd ef216a60
 09:55:28 ipsec,debug,packet a78b6d5e 00000000
 09:55:28 ipsec,debug,packet padding len=1
 09:55:28 ipsec,debug,packet skip to trim padding.
 09:55:28 ipsec,debug,packet decrypted.
 09:55:28 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 05100201 00000000 00000044 0800000c
 09:55:28 ipsec,debug,packet 01000000 51dfb99e 00000018 46b7e5b2 ed677dcd 553ca1bd ef216a60 a78b6d5e
 09:55:28 ipsec,debug,packet 00000000
 09:55:28 ipsec,debug begin.
 09:55:28 ipsec,debug seen nptype=5(id) len=12
 09:55:28 ipsec,debug seen nptype=8(hash) len=24
 09:55:28 ipsec,debug succeed.
 09:55:28 ipsec,debug HASH received:
 09:55:28 ipsec,debug 46b7e5b2 ed677dcd 553ca1bd ef216a60 a78b6d5e
 09:55:28 ipsec,debug,packet HASH with:
 09:55:28 ipsec,debug,packet 04f38f66 f197fffa 9c2a4105 5a80d996 338eb22d 1b431734 ffebedc1 c3658708
 09:55:28 ipsec,debug,packet ad41dde0 9d40baca 3f31e704 ba9fc870 b6e458c9 ece2bc93 a212e89d badd648a
 09:55:28 ipsec,debug,packet eac2e4eb b85bbd0e a3807c00 92f6aa9e 7699a936 3d952f4a 916fb4ca 3c20ba9c
 09:55:28 ipsec,debug,packet 21a83bb3 d48c5ced aa4efbbf e25aa0fb d0af37f1 fdbf8507 6df43751 d2e61f04
 09:55:28 ipsec,debug,packet d3f9a599 c042c32a 298018ff 9af63bb8 9a91dc27 33a3bac5 9e2316bc 673dc002
 09:55:28 ipsec,debug,packet 77c7be49 09d2bf3e fcea0e36 64e0ef85 2b65f2fe 84826fc0 fcc19efa 7edcd62b
 09:55:28 ipsec,debug,packet 070addf5 584d85d1 ed54d389 ac9dba35 dcfe429b 912752f1 3e83cf38 ad2c7cc7
 09:55:28 ipsec,debug,packet c067d7a6 f19a35f0 8755be0e 3b840900 f35dfa05 adc4c8e4 089872c9 914cb281
 09:55:28 ipsec,debug,packet e9c720f9 1b84aab1 378291ab 1ceea724 00000001 00000001 000000d8 01010006
 09:55:28 ipsec,debug,packet 03000024 01010000 800b0001 800c7080 80010007 800e0100 80030001 80020002
 09:55:28 ipsec,debug,packet 8004000e 03000024 02010000 800b0001 800c7080 80010007 800e0100 80030001
 09:55:28 ipsec,debug,packet 80020002 80040002 03000024 03010000 800b0001 800c7080 80010007 800e0080
 09:55:28 ipsec,debug,packet 80030001 80020002 8004000e 03000024 04010000 800b0001 800c7080 80010007
 09:55:28 ipsec,debug,packet 800e0080 80030001 80020002 80040002 03000020 05010000 800b0001 800c7080
 09:55:28 ipsec,debug,packet 80010005 80030001 80020002 8004000e 00000020 06010000 800b0001 800c7080
 09:55:28 ipsec,debug,packet 80010005 80030001 80020002 80040002 01000000 51dfb99e
 09:55:28 ipsec,debug,packet hmac(hmac_sha1)
 09:55:28 ipsec,debug,packet HASH computed:
 09:55:28 ipsec,debug,packet 46b7e5b2 ed677dcd 553ca1bd ef216a60 a78b6d5e
 09:55:28 ipsec,debug HASH for PSK validated.
 09:55:28 ipsec,debug 81.999.185.158 peer's ID:
 09:55:28 ipsec,debug 01000000 51dfb99e
 09:55:28 ipsec,debug ===
 09:55:28 ipsec,debug,packet compute IV for phase2
 09:55:28 ipsec,debug,packet phase1 last IV:
 09:55:28 ipsec,debug,packet 2eaf0b76 ca6da732 1b9e15c2
 09:55:28 ipsec,debug hash(sha1)
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug,packet phase2 IV computed:
 09:55:28 ipsec,debug,packet f983a515 a59934ab
 09:55:28 ipsec,debug,packet HASH with:
 09:55:28 ipsec,debug,packet 1b9e15c2 0000001c 00000001 01106002 378291ab 1ceea724 e9c720f9 1b84aab1
 09:55:28 ipsec,debug,packet hmac(hmac_sha1)
 09:55:28 ipsec,debug,packet HASH computed:
 09:55:28 ipsec,debug,packet 1b14e67d 10ef2e9e 02810e3d d6b6b14d 17940be2
 09:55:28 ipsec,debug,packet begin encryption.
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug,packet pad length = 4
 09:55:28 ipsec,debug,packet 0b000018 1b14e67d 10ef2e9e 02810e3d d6b6b14d 17940be2 0000001c 00000001
 09:55:28 ipsec,debug,packet 01106002 378291ab 1ceea724 e9c720f9 1b84aab1 7c16da03
 09:55:28 ipsec,debug,packet encryption(3des)
 09:55:28 ipsec,debug,packet with key:
 09:55:28 ipsec,debug,packet 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91 6f318097
 09:55:28 ipsec,debug,packet encrypted payload by IV:
 09:55:28 ipsec,debug,packet f983a515 a59934ab
 09:55:28 ipsec,debug,packet save IV for next:
 09:55:28 ipsec,debug,packet 9def9b7f e714241d
 09:55:28 ipsec,debug,packet encrypted.
 09:55:28 ipsec,debug 84 bytes from 80.109.999.132[500] to 81.999.185.158[500]
 09:55:28 ipsec,debug 1 times of 84 bytes message will be sent to 81.999.185.158[500]
 09:55:28 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 08100501 1b9e15c2 00000054 14437c06
 09:55:28 ipsec,debug,packet e7f40f49 1b011808 90082b8f 786c852f 128b72e3 b01dda12 8235499b df0ef2a0
 09:55:28 ipsec,debug,packet 9578d98b f656383e 8d9fdd67 9def9b7f e714241d
 09:55:28 ipsec,debug sendto Information notify.
 09:55:28 ipsec,debug ===
 09:55:29 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:29 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:29 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:29 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:29 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:29 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:29 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:29 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:29 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:29 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:23
 09:55:29 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:55:29 ipsec,debug ===
 09:55:29 ipsec,debug begin QUICK mode.
 09:55:29 ipsec,debug,packet compute IV for phase2
 09:55:29 ipsec,debug,packet phase1 last IV:
 09:55:29 ipsec,debug,packet 2eaf0b76 ca6da732 9190c95d
 09:55:29 ipsec,debug hash(sha1)
 09:55:29 ipsec,debug,packet encryption(3des)
 09:55:29 ipsec,debug,packet phase2 IV computed:
 09:55:29 ipsec,debug,packet 4daf50d5 313e1c64
 09:55:29 ipsec,debug call pfkey_send_getspi 2
 09:55:29 ipsec,debug pfkey GETSPI sent: ESP/Transport 81.999.185.158[500]->80.109.999.132[500] 
 09:55:29 ipsec,debug pfkey getspi sent.
 09:55:29 ipsec,debug use local ID type IPv4_address
 09:55:29 ipsec,debug use remote ID type IPv4_address
 09:55:29 ipsec,debug IDci:
 09:55:29 ipsec,debug 011106a5 506de584
 09:55:29 ipsec,debug IDcr:
 09:55:29 ipsec,debug 011106a5 51dfb99e
 09:55:29 ipsec,debug add payload of len 48, next type 10
 09:55:29 ipsec,debug add payload of len 24, next type 5
 09:55:29 ipsec,debug add payload of len 8, next type 5
 09:55:29 ipsec,debug add payload of len 8, next type 0
 09:55:29 ipsec,debug,packet HASH with:
 09:55:29 ipsec,debug,packet 9190c95d 0a000034 00000001 00000001 00000028 01030401 0c4b4b5e 0000001c
 09:55:29 ipsec,debug,packet 010c0000 80010001 80027080 80040002 80060080 80050002 0500001c eae70f9f
 09:55:29 ipsec,debug,packet 712c0328 f1ac3bf7 7206ce61 47930148 f541665e 0500000c 011106a5 506de584
 09:55:29 ipsec,debug,packet 0000000c 011106a5 51dfb99e
 09:55:29 ipsec,debug,packet hmac(hmac_sha1)
 09:55:29 ipsec,debug,packet HASH computed:
 09:55:29 ipsec,debug,packet 3e4d7966 25572722 18695ca8 ac012393 9bec9687
 09:55:29 ipsec,debug add payload of len 20, next type 1
 09:55:29 ipsec,debug,packet begin encryption.
 09:55:29 ipsec,debug,packet encryption(3des)
 09:55:29 ipsec,debug,packet pad length = 8
 09:55:29 ipsec,debug,packet 01000018 3e4d7966 25572722 18695ca8 ac012393 9bec9687 0a000034 00000001
 09:55:29 ipsec,debug,packet 00000001 00000028 01030401 0c4b4b5e 0000001c 010c0000 80010001 80027080
 09:55:29 ipsec,debug,packet 80040002 80060080 80050002 0500001c eae70f9f 712c0328 f1ac3bf7 7206ce61
 09:55:29 ipsec,debug,packet 47930148 f541665e 0500000c 011106a5 506de584 0000000c 011106a5 51dfb99e
 09:55:29 ipsec,debug,packet accbe90a e7776607
 09:55:29 ipsec,debug,packet encryption(3des)
 09:55:29 ipsec,debug,packet with key:
 09:55:29 ipsec,debug,packet 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91 6f318097
 09:55:29 ipsec,debug,packet encrypted payload by IV:
 09:55:29 ipsec,debug,packet 4daf50d5 313e1c64
 09:55:29 ipsec,debug,packet save IV for next:
 09:55:29 ipsec,debug,packet 0b136945 b306acc5
 09:55:29 ipsec,debug,packet encrypted.
 09:55:29 ipsec,debug 164 bytes from 80.109.999.132[500] to 81.999.185.158[500]
 09:55:29 ipsec,debug 1 times of 164 bytes message will be sent to 81.999.185.158[500]
 09:55:29 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 08102001 9190c95d 000000a4 eba05998
 09:55:29 ipsec,debug,packet 0ef2d4ca 13785779 e4e52f6c 2560e011 93b9d791 53638cce 05853a1d 47e5f046
 09:55:29 ipsec,debug,packet 201e03fe e72e659b 0577448e c7189b41 f6d57a8a 8731e34b 863386ba 9b412056
 09:55:29 ipsec,debug,packet 177ca056 8f90e6e3 09d98926 aea87802 b0b05d1c d0ac1723 f5ffccdd 5ee57858
 09:55:29 ipsec,debug,packet 4e50bac0 5ab1e2bf ad1e7be6 751cf8d8 e97daf2e b136f64e 520691ea 0b136945
 09:55:29 ipsec,debug,packet b306acc5
 09:55:29 ipsec,debug ===== received 172 bytes from 81.999.185.158[500] to 80.109.999.132[500]
 09:55:29 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 08102001 9190c95d 000000ac 559de47e
 09:55:29 ipsec,debug,packet 14efba5a f7500927 92409160 37c47db8 f9e5952e a90d88b7 0a0eeecc 80b6a82f
 09:55:29 ipsec,debug,packet 26968ff3 c7c73251 678bc4fc 9da5bafd 1d5add7d 637e6737 17019596 9348b2b3
 09:55:29 ipsec,debug,packet 3fcec55d 0acff11b 42ea16ac e8158931 bc9fd2d0 ca4bcda3 52abe4e1 7efe645d
 09:55:29 ipsec,debug,packet 84635552 ae249653 eb4b8f13 cc1902e8 5e9cef70 178fb1f1 1047c08f 1fd52f34
 09:55:29 ipsec,debug,packet 0da4f556 3e85ed86 34c97549
 09:55:29 ipsec,debug,packet encryption(3des)
 09:55:29 ipsec,debug,packet IV was saved for next processing:
 09:55:29 ipsec,debug,packet 3e85ed86 34c97549
 09:55:29 ipsec,debug,packet encryption(3des)
 09:55:29 ipsec,debug,packet with key:
 09:55:29 ipsec,debug,packet 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91 6f318097
 09:55:29 ipsec,debug,packet decrypted payload by IV:
 09:55:29 ipsec,debug,packet 0b136945 b306acc5
 09:55:29 ipsec,debug,packet decrypted payload, but not trimed.
 09:55:29 ipsec,debug,packet 01000018 88199e4c f575dc96 7350461a 4672d02c 584088a0 0a000034 00000001
 09:55:29 ipsec,debug,packet 00000001 00000028 01030401 ce4ec69d 0000001c 010c0000 80060080 80050002
 09:55:29 ipsec,debug,packet 80040002 80010001 80027080 05000024 62ea8bad 29812437 abebee77 fb02dc6f
 09:55:29 ipsec,debug,packet 8b33fe36 fa0257ff 1c41e9c1 f90f5f57 0500000c 011106a5 506de584 0000000c
 09:55:29 ipsec,debug,packet 011106a5 51dfb99e 00000000 00000000
 09:55:29 ipsec,debug,packet padding len=1
 09:55:29 ipsec,debug,packet skip to trim padding.
 09:55:29 ipsec,debug,packet decrypted.
 09:55:29 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 08102001 9190c95d 000000ac 01000018
 09:55:29 ipsec,debug,packet 88199e4c f575dc96 7350461a 4672d02c 584088a0 0a000034 00000001 00000001
 09:55:29 ipsec,debug,packet 00000028 01030401 ce4ec69d 0000001c 010c0000 80060080 80050002 80040002
 09:55:29 ipsec,debug,packet 80010001 80027080 05000024 62ea8bad 29812437 abebee77 fb02dc6f 8b33fe36
 09:55:29 ipsec,debug,packet fa0257ff 1c41e9c1 f90f5f57 0500000c 011106a5 506de584 0000000c 011106a5
 09:55:29 ipsec,debug,packet 51dfb99e 00000000 00000000
 09:55:29 ipsec,debug begin.
 09:55:29 ipsec,debug seen nptype=8(hash) len=24
 09:55:29 ipsec,debug seen nptype=1(sa) len=52
 09:55:29 ipsec,debug seen nptype=10(nonce) len=36
 09:55:29 ipsec,debug seen nptype=5(id) len=12
 09:55:29 ipsec,debug seen nptype=5(id) len=12
 09:55:29 ipsec,debug succeed.
 09:55:29 ipsec,debug IDci matches proposal.
 09:55:29 ipsec,debug IDcr matches proposal.
 09:55:29 ipsec,debug HASH allocated:hbuf->l=168 actual:tlen=136
 09:55:29 ipsec,debug HASH(2) received:
 09:55:29 ipsec,debug 88199e4c f575dc96 7350461a 4672d02c 584088a0
 09:55:29 ipsec,debug,packet HASH with:
 09:55:29 ipsec,debug,packet 9190c95d eae70f9f 712c0328 f1ac3bf7 7206ce61 47930148 f541665e 0a000034
 09:55:29 ipsec,debug,packet 00000001 00000001 00000028 01030401 ce4ec69d 0000001c 010c0000 80060080
 09:55:29 ipsec,debug,packet 80050002 80040002 80010001 80027080 05000024 62ea8bad 29812437 abebee77
 09:55:29 ipsec,debug,packet fb02dc6f 8b33fe36 fa0257ff 1c41e9c1 f90f5f57 0500000c 011106a5 506de584
 09:55:29 ipsec,debug,packet 0000000c 011106a5 51dfb99e
 09:55:29 ipsec,debug,packet hmac(hmac_sha1)
 09:55:29 ipsec,debug,packet HASH computed:
 09:55:29 ipsec,debug,packet 88199e4c f575dc96 7350461a 4672d02c 584088a0
 09:55:29 ipsec,debug total SA len=48
 09:55:29 ipsec,debug 00000001 00000001 00000028 01030401 0c4b4b5e 0000001c 010c0000 80010001
 09:55:29 ipsec,debug 80027080 80040002 80060080 80050002
 09:55:29 ipsec,debug begin.
 09:55:29 ipsec,debug seen nptype=2(prop) len=40
 09:55:29 ipsec,debug succeed.
 09:55:29 ipsec,debug proposal #1 len=40
 09:55:29 ipsec,debug begin.
 09:55:29 ipsec,debug seen nptype=3(trns) len=28
 09:55:29 ipsec,debug succeed.
 09:55:29 ipsec,debug transform #1 len=28
 09:55:29 ipsec,debug type=SA Life Type, flag=0x8000, lorv=seconds
 09:55:29 ipsec,debug type=SA Life Duration, flag=0x8000, lorv=28800
 09:55:29 ipsec,debug life duration was in TLV.
 09:55:29 ipsec,debug type=Encryption Mode, flag=0x8000, lorv=Transport
 09:55:29 ipsec,debug type=Key Length, flag=0x8000, lorv=128
 09:55:29 ipsec,debug type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha1
 09:55:29 ipsec,debug pair 1:
 09:55:29 ipsec,debug  0xa0ff0: next=0 tnext=0
 09:55:29 ipsec,debug proposal #1: 1 transform
 09:55:29 ipsec,debug total SA len=48
 09:55:29 ipsec,debug 00000001 00000001 00000028 01030401 ce4ec69d 0000001c 010c0000 80060080
 09:55:29 ipsec,debug 80050002 80040002 80010001 80027080
 09:55:29 ipsec,debug begin.
 09:55:29 ipsec,debug seen nptype=2(prop) len=40
 09:55:29 ipsec,debug succeed.
 09:55:29 ipsec,debug proposal #1 len=40
 09:55:29 ipsec,debug begin.
 09:55:29 ipsec,debug seen nptype=3(trns) len=28
 09:55:29 ipsec,debug succeed.
 09:55:29 ipsec,debug transform #1 len=28
 09:55:29 ipsec,debug type=Key Length, flag=0x8000, lorv=128
 09:55:29 ipsec,debug type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha1
 09:55:29 ipsec,debug type=Encryption Mode, flag=0x8000, lorv=Transport
 09:55:29 ipsec,debug type=SA Life Type, flag=0x8000, lorv=seconds
 09:55:29 ipsec,debug type=SA Life Duration, flag=0x8000, lorv=28800
 09:55:29 ipsec,debug life duration was in TLV.
 09:55:29 ipsec,debug pair 1:
 09:55:29 ipsec,debug  0xa1420: next=0 tnext=0
 09:55:29 ipsec,debug proposal #1: 1 transform
 09:55:29 ipsec,debug begin compare proposals.
 09:55:29 ipsec,debug pair[1]: 0xa1420
 09:55:29 ipsec,debug  0xa1420: next=0 tnext=0
 09:55:29 ipsec,debug prop#=1 prot-id=ESP spi-size=4 #trns=1 trns#=1 trns-id=AES-CBC
 09:55:29 ipsec,debug type=Key Length, flag=0x8000, lorv=128
 09:55:29 ipsec,debug type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha1
 09:55:29 ipsec,debug type=Encryption Mode, flag=0x8000, lorv=Transport
 09:55:29 ipsec,debug type=SA Life Type, flag=0x8000, lorv=seconds
 09:55:29 ipsec,debug type=SA Life Duration, flag=0x8000, lorv=28800
 09:55:29 ipsec,debug peer's single bundle:
 09:55:29 ipsec,debug  (proto_id=ESP spisize=4 spi=ce4ec69d spi_p=00000000 encmode=Transport reqid=0:0)
 09:55:29 ipsec,debug   (trns_id=AES-CBC encklen=128 authtype=hmac-sha1)
 09:55:29 ipsec,debug my single bundle:
 09:55:29 ipsec,debug  (proto_id=ESP spisize=4 spi=0c4b4b5e spi_p=00000000 encmode=Transport reqid=0:0)
 09:55:29 ipsec,debug   (trns_id=AES-CBC encklen=128 authtype=hmac-sha1)
 09:55:29 ipsec,debug matched
 09:55:29 ipsec,debug ===
 09:55:29 ipsec,debug HASH(3) generate
 09:55:29 ipsec,debug,packet HASH with: 
 09:55:29 ipsec,debug,packet 009190c9 5deae70f 9f712c03 28f1ac3b f77206ce 61479301 48f54166 5e62ea8b
 09:55:29 ipsec,debug,packet ad298124 37abebee 77fb02dc 6f8b33fe 36fa0257 ff1c41e9 c1f90f5f 57
 09:55:29 ipsec,debug,packet hmac(hmac_sha1)
 09:55:29 ipsec,debug,packet HASH computed:
 09:55:29 ipsec,debug,packet 3a94ed6b 714f70d7 796848c9 62f5ee85 ba68922b
 09:55:29 ipsec,debug add payload of len 20, next type 0
 09:55:29 ipsec,debug,packet begin encryption.
 09:55:29 ipsec,debug,packet encryption(3des)
 09:55:29 ipsec,debug,packet pad length = 8
 09:55:29 ipsec,debug,packet 00000018 3a94ed6b 714f70d7 796848c9 62f5ee85 ba68922b 63d2a5c0 03ce5f07
 09:55:29 ipsec,debug,packet encryption(3des)
 09:55:29 ipsec,debug,packet with key:
 09:55:29 ipsec,debug,packet 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91 6f318097
 09:55:29 ipsec,debug,packet encrypted payload by IV:
 09:55:29 ipsec,debug,packet 3e85ed86 34c97549
 09:55:29 ipsec,debug,packet save IV for next:
 09:55:29 ipsec,debug,packet fe2092cc 26045561
 09:55:29 ipsec,debug,packet encrypted.
 09:55:29 ipsec,debug 60 bytes from 80.109.999.132[500] to 81.999.185.158[500]
 09:55:29 ipsec,debug 1 times of 60 bytes message will be sent to 81.999.185.158[500]
 09:55:29 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 08102001 9190c95d 0000003c 5391b09e
 09:55:29 ipsec,debug,packet 21756d1b 6bed86f7 f4b0319c beee07e2 cc1212e3 fe2092cc 26045561
 09:55:29 ipsec,debug,packet KEYMAT compute with
 09:55:29 ipsec,debug,packet 030c4b4b 5eeae70f 9f712c03 28f1ac3b f77206ce 61479301 48f54166 5e62ea8b
 09:55:29 ipsec,debug,packet ad298124 37abebee 77fb02dc 6f8b33fe 36fa0257 ff1c41e9 c1f90f5f 57
 09:55:29 ipsec,debug,packet hmac(hmac_sha1)
 09:55:29 ipsec,debug encryption(aes-cbc)
 09:55:29 ipsec,debug hmac(sha1)
 09:55:29 ipsec,debug encklen=128 authklen=160
 09:55:29 ipsec,debug generating 480 bits of key (dupkeymat=3)
 09:55:29 ipsec,debug generating K1...K3 for KEYMAT.
 09:55:29 ipsec,debug,packet hmac(hmac_sha1)
 09:55:29 ipsec,debug,packet hmac(hmac_sha1)
 09:55:29 ipsec,debug 0f02bf0a 68617e78 f4cd4503 2a8fe13a 3b8da686 fd68f63e 7bfe6305 7ed96d5b
 09:55:29 ipsec,debug fad98683 12d542b8 df2b1184 e0a0fe2f a8ea797e 81e9bd6e b677fd6a
 09:55:29 ipsec,debug,packet KEYMAT compute with
 09:55:29 ipsec,debug,packet 03ce4ec6 9deae70f 9f712c03 28f1ac3b f77206ce 61479301 48f54166 5e62ea8b
 09:55:29 ipsec,debug,packet ad298124 37abebee 77fb02dc 6f8b33fe 36fa0257 ff1c41e9 c1f90f5f 57
 09:55:29 ipsec,debug,packet hmac(hmac_sha1)
 09:55:29 ipsec,debug encryption(aes-cbc)
 09:55:29 ipsec,debug hmac(sha1)
 09:55:29 ipsec,debug encklen=128 authklen=160
 09:55:29 ipsec,debug generating 480 bits of key (dupkeymat=3)
 09:55:29 ipsec,debug generating K1...K3 for KEYMAT.
 09:55:29 ipsec,debug,packet hmac(hmac_sha1)
 09:55:29 ipsec,debug,packet hmac(hmac_sha1)
 09:55:29 ipsec,debug ad8fc174 fde6688b 9ea2730d 21fb4589 d9b668b4 a561c49c 1450348c 91b33a17
 09:55:29 ipsec,debug 91d94413 1d2c60d8 941c9b22 ffcba2ae 693047b1 364fd2ba f8c121ed
 09:55:29 ipsec,debug KEYMAT computed.
 09:55:29 ipsec,debug call pk_sendupdate
 09:55:29 ipsec,debug encryption(aes-cbc)
 09:55:29 ipsec,debug hmac(sha1)
 09:55:29 ipsec,debug call pfkey_send_update_nat
 09:55:29 ipsec,debug pfkey update sent.
 09:55:29 ipsec,debug encryption(aes-cbc)
 09:55:29 ipsec,debug hmac(sha1)
 09:55:29 ipsec,debug call pfkey_send_add_nat
 09:55:29 ipsec,debug pfkey add sent.
 09:55:30 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:30 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:30 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:30 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:30 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:30 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:30 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:30 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:30 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:30 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:23
 09:55:30 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:55:32 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:32 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:32 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:32 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:32 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:32 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:32 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:32 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:32 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:32 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:23
 09:55:32 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:55:36 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:36 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:36 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:36 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:36 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:36 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:36 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:36 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:36 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:36 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:23
 09:55:36 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:55:44 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:44 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:44 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:44 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:44 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:44 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:44 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:44 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:44 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:44 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:23
 09:55:44 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:55:52 l2tp,debug tunnel 35 received no replies, disconnecting
 09:55:52 l2tp,debug tunnel 35 entering state: dead
 09:55:52 l2tp,debug session 43 entering state: dead
 09:55:52 l2tp,ppp,debug wid-client-vpn: CCP close
 09:55:52 l2tp,ppp,debug wid-client-vpn: BCP close
 09:55:52 l2tp,ppp,debug wid-client-vpn: IPCP close
 09:55:52 l2tp,ppp,debug wid-client-vpn: IPV6CP close
 09:55:52 l2tp,ppp,debug wid-client-vpn: MPLSCP close
 09:55:52 l2tp,ppp,debug wid-client-vpn: LCP lowerdown
 09:55:52 l2tp,ppp,debug wid-client-vpn: LCP down event in initial state
 09:55:52 l2tp,ppp,debug wid-client-vpn: IPCP demandUp
 09:55:52 l2tp,ppp,debug wid-client-vpn: IPV6CP demandUp
 09:55:53 l2tp,debug tunnel 36 entering state: wait-ctl-reply
 09:55:53 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:53 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:53 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:53 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:53 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:53 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:53 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:53 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:53 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:53 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:24
 09:55:53 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:55:54 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:54 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:54 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:54 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:54 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:54 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:54 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:54 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:54 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:54 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:24
 09:55:54 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:55:55 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:55 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:55 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:55 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:55 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:55 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:55 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:55 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:55 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:55 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:24
 09:55:55 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:55:57 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:55:57 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:55:57 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:55:57 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:55:57 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:55:57 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:55:57 l2tp,debug,packet     Firmware-Revision=0x1
 09:55:57 l2tp,debug,packet     (M) Host-Name="router-main"
 09:55:57 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:55:57 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:24
 09:55:57 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:56:01 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:56:01 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:56:01 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:56:01 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:56:01 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:56:01 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:56:01 l2tp,debug,packet     Firmware-Revision=0x1
 09:56:01 l2tp,debug,packet     (M) Host-Name="router-main"
 09:56:01 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:56:01 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:24
 09:56:01 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:56:09 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:56:09 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:56:09 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:56:09 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:56:09 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:56:09 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:56:09 l2tp,debug,packet     Firmware-Revision=0x1
 09:56:09 l2tp,debug,packet     (M) Host-Name="router-main"
 09:56:09 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:56:09 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:24
 09:56:09 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:56:17 l2tp,debug tunnel 36 received no replies, disconnecting
 09:56:17 l2tp,debug tunnel 36 entering state: dead
 09:56:17 l2tp,debug session 44 entering state: dead
 09:56:17 l2tp,ppp,debug wid-client-vpn: CCP close
 09:56:17 l2tp,ppp,debug wid-client-vpn: BCP close
 09:56:17 l2tp,ppp,debug wid-client-vpn: IPCP close
 09:56:17 l2tp,ppp,debug wid-client-vpn: IPV6CP close
 09:56:17 l2tp,ppp,debug wid-client-vpn: MPLSCP close
 09:56:17 l2tp,ppp,debug wid-client-vpn: LCP lowerdown
 09:56:17 l2tp,ppp,debug wid-client-vpn: LCP down event in initial state
 09:56:17 l2tp,ppp,debug wid-client-vpn: IPCP demandUp
 09:56:17 l2tp,ppp,debug wid-client-vpn: IPV6CP demandUp
 09:56:18 l2tp,debug tunnel 37 entering state: wait-ctl-reply
 09:56:18 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:56:18 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:56:18 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:56:18 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:56:18 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:56:18 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:56:18 l2tp,debug,packet     Firmware-Revision=0x1
 09:56:18 l2tp,debug,packet     (M) Host-Name="router-main"
 09:56:18 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:56:18 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:25
 09:56:18 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:56:19 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:56:19 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:56:19 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:56:19 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:56:19 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:56:19 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:56:19 l2tp,debug,packet     Firmware-Revision=0x1
 09:56:19 l2tp,debug,packet     (M) Host-Name="router-main"
 09:56:19 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:56:19 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:25
 09:56:19 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:56:20 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:56:20 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:56:20 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:56:20 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:56:20 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:56:20 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:56:20 l2tp,debug,packet     Firmware-Revision=0x1
 09:56:20 l2tp,debug,packet     (M) Host-Name="router-main"
 09:56:20 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:56:20 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:25
 09:56:20 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:56:22 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:56:22 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:56:22 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:56:22 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:56:22 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:56:22 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:56:22 l2tp,debug,packet     Firmware-Revision=0x1
 09:56:22 l2tp,debug,packet     (M) Host-Name="router-main"
 09:56:22 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:56:22 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:25
 09:56:22 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:56:26 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:56:26 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:56:26 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:56:26 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:56:26 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:56:26 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:56:26 l2tp,debug,packet     Firmware-Revision=0x1
 09:56:26 l2tp,debug,packet     (M) Host-Name="router-main"
 09:56:26 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:56:26 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:25
 09:56:26 l2tp,debug,packet     (M) Receive-Window-Size=4
 09:56:29 l2tp,ppp,debug wid-client-vpn: CCP close
 09:56:29 l2tp,ppp,debug wid-client-vpn: BCP close
 09:56:29 l2tp,ppp,debug wid-client-vpn: IPCP close
 09:56:29 l2tp,ppp,debug wid-client-vpn: IPV6CP close
 09:56:29 l2tp,ppp,debug wid-client-vpn: MPLSCP close
 09:56:29 l2tp,debug session 45 entering state: stopping
 09:56:29 l2tp,ppp,debug wid-client-vpn: LCP lowerdown
 09:56:29 l2tp,ppp,debug wid-client-vpn: LCP down event in initial state
 09:56:30 l2tp,debug session 45 entering state: dead
 09:56:30 l2tp,debug tunnel 37 entering state: stopping
 09:56:30 ipsec,debug Deleting a Ph2...
 09:56:30 ipsec,debug,packet compute IV for phase2
 09:56:30 ipsec,debug,packet phase1 last IV:
 09:56:30 ipsec,debug,packet 2eaf0b76 ca6da732 515b76c0
 09:56:30 ipsec,debug hash(sha1)
 09:56:30 ipsec,debug,packet encryption(3des)
 09:56:30 ipsec,debug,packet phase2 IV computed:
 09:56:30 ipsec,debug,packet 62924788 f2df1b27
 09:56:30 ipsec,debug,packet HASH with:
 09:56:30 ipsec,debug,packet 515b76c0 00000010 00000001 03040001 0c4b4b5e
 09:56:30 ipsec,debug,packet hmac(hmac_sha1)
 09:56:30 ipsec,debug,packet HASH computed:
 09:56:30 ipsec,debug,packet 8df56916 8630045e 3e61120c f1d7dfca 7fdb065c
 09:56:30 ipsec,debug,packet begin encryption.
 09:56:30 ipsec,debug,packet encryption(3des)
 09:56:30 ipsec,debug,packet pad length = 8
 09:56:30 ipsec,debug,packet 0c000018 8df56916 8630045e 3e61120c f1d7dfca 7fdb065c 00000010 00000001
 09:56:30 ipsec,debug,packet 03040001 0c4b4b5e a8d9c8a6 44882707
 09:56:30 ipsec,debug,packet encryption(3des)
 09:56:30 ipsec,debug,packet with key:
 09:56:30 ipsec,debug,packet 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91 6f318097
 09:56:30 ipsec,debug,packet encrypted payload by IV:
 09:56:30 ipsec,debug,packet 62924788 f2df1b27
 09:56:30 ipsec,debug,packet save IV for next:
 09:56:30 ipsec,debug,packet 974e7145 22d3841e
 09:56:30 ipsec,debug,packet encrypted.
 09:56:30 ipsec,debug 76 bytes from 80.109.999.132[500] to 81.999.185.158[500]
 09:56:30 ipsec,debug 1 times of 76 bytes message will be sent to 81.999.185.158[500]
 09:56:30 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 08100501 515b76c0 0000004c 8ac85b1d
 09:56:30 ipsec,debug,packet 5e0b73ae effca2ff 05fd4628 6ff17e65 a27c8330 414bee1c 1049385f 4f133ce2
 09:56:30 ipsec,debug,packet aa00282c 974e7145 22d3841e
 09:56:30 ipsec,debug sendto Information delete.
 09:56:30 ipsec,debug Removing PH1...
 09:56:30 ipsec,debug,packet compute IV for phase2
 09:56:30 ipsec,debug,packet phase1 last IV:
 09:56:30 ipsec,debug,packet 2eaf0b76 ca6da732 0434ceaa
 09:56:30 ipsec,debug hash(sha1)
 09:56:30 ipsec,debug,packet encryption(3des)
 09:56:30 ipsec,debug,packet phase2 IV computed:
 09:56:30 ipsec,debug,packet 95575303 c76a3f8c
 09:56:30 ipsec,debug,packet HASH with:
 09:56:30 ipsec,debug,packet 0434ceaa 0000001c 00000001 01100001 378291ab 1ceea724 e9c720f9 1b84aab1
 09:56:30 ipsec,debug,packet hmac(hmac_sha1)
 09:56:30 ipsec,debug,packet HASH computed:
 09:56:30 ipsec,debug,packet 1b756bea fe017744 cea7b60b f7acfb96 4e07c6f5
 09:56:30 ipsec,debug,packet begin encryption.
 09:56:30 ipsec,debug,packet encryption(3des)
 09:56:30 ipsec,debug,packet pad length = 4
 09:56:30 ipsec,debug,packet 0c000018 1b756bea fe017744 cea7b60b f7acfb96 4e07c6f5 0000001c 00000001
 09:56:30 ipsec,debug,packet 01100001 378291ab 1ceea724 e9c720f9 1b84aab1 d601c703
 09:56:30 ipsec,debug,packet encryption(3des)
 09:56:30 ipsec,debug,packet with key:
 09:56:30 ipsec,debug,packet 7af18c69 7cc5ab13 b5f174fc 157d82bc de133d91 6f318097
 09:56:30 ipsec,debug,packet encrypted payload by IV:
 09:56:30 ipsec,debug,packet 95575303 c76a3f8c
 09:56:30 ipsec,debug,packet save IV for next:
 09:56:30 ipsec,debug,packet 6bf820e4 764cf151
 09:56:30 ipsec,debug,packet encrypted.
 09:56:30 ipsec,debug 84 bytes from 80.109.999.132[500] to 81.999.185.158[500]
 09:56:30 ipsec,debug 1 times of 84 bytes message will be sent to 81.999.185.158[500]
 09:56:30 ipsec,debug,packet 378291ab 1ceea724 e9c720f9 1b84aab1 08100501 0434ceaa 00000054 1d004c8c
 09:56:30 ipsec,debug,packet dfdd2759 6ff68188 62560931 32983507 7ed6f6d6 e0029a11 88837320 6d72789a
 09:56:30 ipsec,debug,packet ce5e10ab 11121e75 78a23b8c 6bf820e4 764cf151
 09:56:30 ipsec,debug sendto Information delete.
 09:56:34 l2tp,debug,packet sent control message to 81.999.185.158:1701 from 80.109.999.132:1701
 09:56:34 l2tp,debug,packet     proto version 2, tunnel-id=0, session-id=0, ns=0, nr=0
 09:56:34 l2tp,debug,packet     (M) Message-Type=SCCRQ
 09:56:34 l2tp,debug,packet     (M) Protocol-Version=0x01:00
 09:56:34 l2tp,debug,packet     (M) Framing-Capabilities=0x1
 09:56:34 l2tp,debug,packet     (M) Bearer-Capabilities=0x0
 09:56:34 l2tp,debug,packet     Firmware-Revision=0x1
 09:56:34 l2tp,debug,packet     (M) Host-Name="router-main"
 09:56:34 l2tp,debug,packet     Vendor-Name="MikroTik"
 09:56:34 l2tp,debug,packet     (M) Assigned-Tunnel-ID=0x00:25
 09:56:34 l2tp,debug,packet     (M) Receive-Window-Size=4
Top
 
johnson73
Member Candidate
Member Candidate
Posts: 196
Joined: Wed Feb 05, 2020 10:07 am

Re: IPsec over L2TP (Client-VPN) not starting anymore

Thu May 23, 2024 3:06 pm

What does your incoming traffic config look like? Input chain rules? Maybe you can copy the firewall filter section?
Top
 
User avatar
florianmulatz
newbie
Topic Author
Posts: 47
Joined: Mon Sep 16, 2013 5:02 pm
Location: Klagenfurt am Woerthersee / Austria

Re: IPsec over L2TP (Client-VPN) not starting anymore

Fri May 24, 2024 11:35 am

What does your incoming traffic config look like? Input chain rules? Maybe you can copy the firewall filter section?
for sure - here you go (just wanted to mention that even a complete disabling of all firewall rules also makes no difference):
Code: Select all
/ip firewall filter
add action=accept chain=input comment="CAPSMANAGER Discovery" protocol=udp src-port=5246,5247
add action=accept chain=input comment="CAPSMANAGER Discovery" dst-port=5246,5247 protocol=udp
add action=accept chain=input comment=WireGuard dst-port=13231 in-interface="ether9 - UPC" log=yes log-prefix=\
    WIREGUARD protocol=udp
add action=accept chain=input comment="default configuration" connection-state=established,related
add action=accept chain=input src-address-list=LAN
add action=accept chain=input protocol=icmp
add action=accept chain=forward dst-address=10.0.207.0/24 src-address-list=WID_allowed_clients
add action=accept chain=forward dst-address=192.168.99.0/24 src-address-list=OGRIS_allowed_clients
add action=accept chain=forward dst-address=192.168.98.0/24 src-address-list=MULATZ_allowed_clients
add action=accept chain=forward comment="allow users out wireguard" in-interface-list=LIST_LAN out-interface=\
    WG_local-SR
add action=accept chain=forward comment="allow select user to local subnet" dst-address=192.168.100.0/23 \
    in-interface=WG_local-SR
add action=jump chain=forward dst-address=10.0.207.0/24 jump-target=DROP src-address-list=!WID_allowed_clients
add action=jump chain=forward dst-address=192.168.99.0/24 jump-target=DROP src-address-list=!OGRIS_allowed_clients
add action=jump chain=forward dst-address=192.168.98.0/24 jump-target=DROP src-address-list=!MULATZ_allowed_clients
add action=drop chain=forward comment=" drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=LIST_WAN
add action=drop chain=input
add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="Established, Related" connection-state=established,related
add action=drop chain=forward comment="Drop invalid" connection-state=invalid log=yes log-prefix=invalid
add action=drop chain=forward comment="Drop tries to reach not public addresses from LAN" dst-address-list=\
    not_in_internet in-interface=BR_LAN log=yes log-prefix=!public_from_LAN out-interface=!BR_LAN
add action=jump chain=forward comment="jump to ICMP filters" jump-target=icmp protocol=icmp
add action=drop chain=forward comment="Drop packets from LAN that do not have LAN IP" in-interface=BR_LAN log=yes \
    log-prefix=LAN_!LAN src-address=!192.168.100.0/23
add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=icmp
add action=accept chain=icmp comment="net unreachable" icmp-options=3:0 protocol=icmp
add action=accept chain=icmp comment="host unreachable" icmp-options=3:1 protocol=icmp
add action=accept chain=icmp comment="host unreachable fragmentation required" icmp-options=3:4 protocol=icmp
add action=accept chain=icmp comment="allow echo request" icmp-options=8:0 protocol=icmp
add action=accept chain=icmp comment="allow time exceed" icmp-options=11:0 protocol=icmp
add action=accept chain=icmp comment="allow parameter bad" icmp-options=12:0 protocol=icmp
add action=drop chain=icmp comment="deny all other types"
add action=drop chain=DROP log=yes log-prefix="CHAIN_DROP: "
Top
 
johnson73
Member Candidate
Member Candidate
Posts: 196
Joined: Wed Feb 05, 2020 10:07 am

Re: IPsec over L2TP (Client-VPN) not starting anymore

Fri May 24, 2024 3:07 pm

So that the traffic works stably and there are no overlaps, I recommend arranging the rolls in sequence. Input rules at input, forward- at forward. Rules policy is executed from the top down and it affects the operation of the traffic flow.
We should also fix the entries where we see allowed_clients.
They are usually defined by the ``Input chain'' and correspondingly using the address list.
You can also not use forward chain ICMP rules. If, however, you feel that you need to limit icmp flood, then the following entries in the "Input" section will be completely sufficient -
/ip firewall filter
add action=accept chain=input comment="Access Normal Ping" in-interface-list=WAN limit=50/5s,2:packet protocol=icmp
add action=drop chain=input comment="Drop excess pings" in-interface-list=WAN protocol=icmp
As an example:
Code: Select all
/ip firewall filter
{Input Chain}
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input src-address-list=Admin comment="Config Access"
add action=accept chain=input comment=L2TP dst-port=500,1701,4500 \
    in-interface-list=WAN protocol=udp
add action=accept chain=input comment="IKE IPSec" in-interface-list=WAN \
    protocol=ipsec-esp
add action=drop chain=input comment="drop all else"
{forward chain}
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="allow internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow dst-nat from both WAN and LAN (including port forwarding)" connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
Last edited by johnson73 on Fri May 24, 2024 5:59 pm, edited 1 time in total.
Top
 
User avatar
florianmulatz
newbie
Topic Author
Posts: 47
Joined: Mon Sep 16, 2013 5:02 pm
Location: Klagenfurt am Woerthersee / Austria

Re: IPsec over L2TP (Client-VPN) not starting anymore

Fri May 24, 2024 5:24 pm

Hi again,

Thx for your answer. I'm not sure if you maybe mix something up. Can you explain why are you showing an L2TP Server configuration b'cause I said that my mikrotik is working as client-device for the VPN.

Also please ignore the "allowed Clients" rules - which are also not valid for this purpose but for completely different WireGuard VPN which does not have anyhting to do with this L2TP over IPSEC Client-VPN Configuration.

Maybe I'm misinterpreting your answers so please enlighten the dark for me :)

Thx in advance!
Florian
Top
 
johnson73
Member Candidate
Member Candidate
Posts: 196
Joined: Wed Feb 05, 2020 10:07 am

Re: IPsec over L2TP (Client-VPN) not starting anymore

Fri May 24, 2024 6:08 pm

Ok, maybe I wrote too much, sorry..
But if you arrange the firewall records in order (the input section contains Input records, forward-forward records), after that do you still have problems with operational stability? End the Input section with "drop all" and also end the Forward section with "drop all".
What is going on with your dns-53 port? It is not flooded? Internet channel is not overloaded? It also affects vpn stability. I have encountered such a situation with my clients. The solution was to allow 53 -no LAN interface. Raw chain I dropped dns 53 requests from outside

I usually use a firewall configuration like the one I copied here. Of course, we can supplement it with the records we need. There are no problems. I have Mikrotik ->Fortigate vpn connections created on several objects. Everything works stably. Ok, in your case it's Cisco.
If the situation does not improve after configuration changes on the mikrotik, see what is happening on the Cisco side.
Top
 
User avatar
florianmulatz
newbie
Topic Author
Posts: 47
Joined: Mon Sep 16, 2013 5:02 pm
Location: Klagenfurt am Woerthersee / Austria

Re: IPsec over L2TP (Client-VPN) not starting anymore

Sat May 25, 2024 8:13 am

Ok, maybe I wrote too much, sorry..
But if you arrange the firewall records in order (the input section contains Input records, forward-forward records), after that do you still have problems with operational stability? End the Input section with "drop all" and also end the Forward section with "drop all".
What is going on with your dns-53 port? It is not flooded? Internet channel is not overloaded? It also affects vpn stability. I have encountered such a situation with my clients. The solution was to allow 53 -no LAN interface. Raw chain I dropped dns 53 requests from outside

I usually use a firewall configuration like the one I copied here. Of course, we can supplement it with the records we need. There are no problems. I have Mikrotik ->Fortigate vpn connections created on several objects. Everything works stably. Ok, in your case it's Cisco.
If the situation does not improve after configuration changes on the mikrotik, see what is happening on the Cisco side.

Hi again!

Maybe we're loosing the track. I do not have "stability problems" - the tunnel does not even start up anymore - it doesn't matter in which order the rules are in the firewall - i tried it with your suggest as well.
I think the firewall rule set is irrelevant in this particular context. I don't understand why you are so focused on that ;)

No my Internet-Connection is not overloaded neither is DNS flooded. Nothing strange at all (except the non working VPN ;))

As mentioned in the first post, unfortunately I don't have access to the Cisco firewall as it is managed by the service provider. Also, the client VPN works fine on a Windows computer - it just suddenly stopped working on the Mikrotik. This fact that the VPN continues to work fine on a Windows computer underlines that I don't think the problem is at the firewall level.

This is - jftr - the one I came out for now:
Code: Select all
/ip firewall filter add action=accept chain=input port=1701,500,4500 protocol=udp
/ip firewall filter add action=accept chain=input protocol=ipsec-esp
/ip firewall filter add action=accept chain=input in-interface-list=LIST_WAN protocol=icmp
/ip firewall filter add action=accept chain=input comment=WireGuard dst-port=13231 in-interface-list=LIST_WAN log=yes log-prefix=WIREGUARD protocol=udp
/ip firewall filter add action=accept chain=input comment="default configuration" connection-state=established,related
/ip firewall filter add action=accept chain=input src-address-list=LAN
/ip firewall filter add action=accept chain=input protocol=icmp
/ip firewall filter add action=drop chain=input
/ip firewall filter add action=accept chain=forward comment="allow dst-nat from both WAN and LAN (including port forwarding)" connection-nat-state=dstnat
/ip firewall filter add action=accept chain=forward dst-address=10.0.207.0/24 src-address-list=WID_allowed_clients
/ip firewall filter add action=accept chain=forward dst-address=192.168.99.0/24 src-address-list=OGRIS_allowed_clients
/ip firewall filter add action=accept chain=forward dst-address=192.168.98.0/24 src-address-list=MULATZ_allowed_clients
/ip firewall filter add action=accept chain=forward comment="allow users out wireguard" in-interface-list=LIST_LAN out-interface=WG_local-SR
/ip firewall filter add action=accept chain=forward comment="allow select user to local subnet" dst-address=192.168.100.0/23 in-interface=WG_local-SR
/ip firewall filter add action=jump chain=forward dst-address=10.0.207.0/24 jump-target=DROP src-address-list=!WID_allowed_clients
/ip firewall filter add action=jump chain=forward dst-address=192.168.99.0/24 jump-target=DROP src-address-list=!OGRIS_allowed_clients
/ip firewall filter add action=jump chain=forward dst-address=192.168.98.0/24 jump-target=DROP src-address-list=!MULATZ_allowed_clients
/ip firewall filter add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
/ip firewall filter add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
/ip firewall filter add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related hw-offload=yes
/ip firewall filter add action=accept chain=forward comment="Established, Related, Untracked" connection-state=established,related,untracked
/ip firewall filter add action=drop chain=forward comment="Drop tries to reach not public addresses from LAN" dst-address-list=not_in_internet in-interface=BR_LAN log=yes log-prefix=!public_from_LAN out-interface=!BR_LAN
/ip firewall filter add action=drop chain=forward comment=" drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=LIST_WAN
/ip firewall filter add action=drop chain=forward comment="Drop invalid" connection-state=invalid log=yes log-prefix=invalid
/ip firewall filter add action=drop chain=forward comment="Drop packets from LAN that do not have LAN IP" in-interface=BR_LAN log=yes log-prefix=LAN_!LAN src-address=!192.168.100.0/23
/ip firewall filter add action=drop chain=DROP log=yes log-prefix="CHAIN_DROP: "
Top
 
johnson73
Member Candidate
Member Candidate
Posts: 196
Joined: Wed Feb 05, 2020 10:07 am

Re: IPsec over L2TP (Client-VPN) not starting anymore

Sat May 25, 2024 9:16 am

Why focus specifically on policy? Because in 98% of cases there is an incomprehensible mix with firewall records on the client end. All this affects traffic stability. Making changes will usually resolve the issues. Of course, not all cases are the same, but most of them are. That's why I asked you.

There is no way to check Cisco? There has been a case where restarting the provider's router solves the problem. But I think you have already done such a thing. Interesting, still have to think..
Top
 
User avatar
florianmulatz
newbie
Topic Author
Posts: 47
Joined: Mon Sep 16, 2013 5:02 pm
Location: Klagenfurt am Woerthersee / Austria

Re: IPsec over L2TP (Client-VPN) not starting anymore  [SOLVED]

Mon May 27, 2024 9:15 am

Hi Guys!

The solution was to simply reboot the Cisco firewall - pity I hadn't thought of that myself :O

Thx @ all for your help indeed!

Cheers
Top
Post Reply

Who is online

Users browsing this forum: 4l4R1, ryba84, TeWe and 33 guests
  4. RouterOS
  5. General