I am excited to learn Mikrotik released LNS functionality - been dreaming of it for a long time Our DSL subscription base is small, Mikrotik would make a perfect fit to serve as LNS. Although the LNS seemed to work, there were problems I was unable to solve in the maintenance window sadly. I attribute the combination of being tired and not fulling knowing PPP to be part of my failure in definitively diagnosing the issue.

Here are some steps I took to bring the LNS up:

- started work at 3:30am to 5:30am minimize disruption to customers
- brand new CCR1009-8G-1S with ROS 6.33.3 loaded / vanilla installation (standard stuff)
- set up the P2P /29 IP addresses Bell provides us (3 IPs for our LNS equipment - for load balancing, all 3 IPs terminated to same MT CCR) Bell does this so that the ISP can have a few units for redundancy/failover/balancing/etc
- configured routes - Bell provides us with 2 /23's & default route installed/tested
- tested P2P and routes by pinging (setting source IP as well)
- verified 'jumbo' frame sizes on physical and VLAN interface to Bell
- verified RADIUS server connection
- Enabled L2TP server, adjusted MTU/MRU to 1480, used mschap2/mschap1/chap/pap authentication, set Use IPsec and entered in IPSec Secret
- Under LT2P Secrets, I added the 'secret key' to the subnets involved (the two /23's from Bell and the /29 P2P from Bell)
- Under IP IPpool - I set up a /25 pool under "pool1" (we are small) for dynamic customers (most customers are static IP outside of this pool, still small however)
- Under PPP Profiles, I edited both default and default-encryption profiles to have the local address of the router, and the remote address to be 'pool1' (for dynamic IP customers) + DNS server numbers

What's next? Time to jockey around some VLANs on our Bell carrier facing switching platform to re-direct the L2TP traffic from the old LNS to the new Mikrotik LNS (and the internet uplink on the new Mikrotik LNS CCR1009)

"Patiently wait"..... and wait, and wait,

Familiar customer sessions are beginning to populate in the PPP->Active Connections index!!

Do a few ping tests, everything seems to be good.

SOMETHING WRONG: After a while, I observe that only about half or two-thirds of our customers connect. (This is what I was unable to resolve) Here are some observations/troubleshooting steps I took:

- Bell gives us two /23's to connect to the Broadband Access Servers on their network (BAS) 67.69.X.X and 184.150.X.X

- All successful L2TP/PPP sessions seem to be coming in from hosts on the 184.150.X.X space
- All sessions I would expect to see that originate from the 67.69.X.X space are not working
- I note in the Mikrotik LOG that there are messages "first L2TP UDP packet recieved from 67.69.XXX.XXX" (the space where we have NO working PPP sessions)
- I see only one of two Log messages indicating the same for the 184.150.XXX.XXX space (this is the space where we have working sessions)

I 'played' around by enabling/disabling IPSec and the L2TP Secrets. I found this surprising as I thought the main issue with Mikrotik LNS up to this point is it would not support this form of security. The sessions still worked despite adjusting the security key settings (perhaps this is because the sessions were already established earlier and the changes had no immediate effect)

Packet capturing and filtering to the 67.69.X.X space showed sessions being presented to the Mikrotik LNS, I could see the passwords in clear text.

Packet capturing and filtering to the 184.150.X.X space showed sessions, I didn't observe any authentication requests, but I suspect this has to do with the sessions having already been established earlier despite disabling and re-enabling the L2TP server. This could be a reboot/patience thing.

If anyone has any ideas/suggestions, I am open to them. I am determined to make this work. I noted the lack of documentation on how to establish the LNS features, perhaps this could help others set up their environment. It will be slow to diagnose as I am working on a live system and need to make attempts in maintenance windows.

Hi

interesting. Could you post a config example?

Regards Patrick

Another user on the forum (rahrouh) posted some news about the latest release candidate working for Bell LNS. We noticed issues with sessions to the Juniper equipment that Bell uses. This is now resolved. I installed 6.35rc12 on the Mikrotik CCR1009 and all sessions are now functioning. Hat's off to Mikrotik. I can finally toss the power hungry Cisco gear. Mikrotik, we love you!

Yes it is great work from Mikrotik !

This feature has been long awaited, and finally it is complete.

Hats off to the guys at Mikrotik who made this happen.

How has this progressed since the beginning of the year?

I need to decommission my Cisco LNS and have the Mikrotik do that task. Any further configuration details you can share?


Regards,
Andrew Bongard
Tube-e Communications Inc.

Anyone using Mikrotik LNS with Bell Canada care to share the L2TP Server Settings? Max MTU and MRU MRRU, Keep Alive Timeout, Authentication type etc.?

Does anyone have a working template or config snip that they can share for the Bell LNS config? I'm moving our Cisco to Mikrotik this week and believe I have it mostly programmed correctly. Just looking for a working code base that I can reference to see if I've missed anything.

Anyone using Mikrotik LNS with Bell Canada care to share the L2TP Server Settings? Max MTU and MRU MRRU, Keep Alive Timeout, Authentication type etc.?

Hi Greg,
How did you guys make out with this? Any luck getting things going on your end with the Mikrotik and Bell service? Looks like we're fighting the same battle here!

Anyone using Mikrotik LNS with Bell Canada care to share the L2TP Server Settings? Max MTU and MRU MRRU, Keep Alive Timeout, Authentication type etc.?

Hi Greg,
How did you guys make out with this? Any luck getting things going on your end with the Mikrotik and Bell service? Looks like we're fighting the same battle here!

There's a brief example config in this post: viewtopic.php?f=1&t=26698&start=100#p610418

Bell provided some information to setup the AGAS connection with them, which include an IP you have to assign to your router, static routes and which VLANs you need to use. I put those in as requested. The tunnel password can be configured the way that's in the example config I linked, or if you're also using L2TP for other purposes on the same router (Remote management VPN, ect) like I am, you can take the destination subnet routes that Bell gave you and use them for the "Address" field for the L2TP Secrets. So, if they gave you routes for 1.1.1.1/22 and 2.2.2.2/22, you would put in something like: Bell also gives you the option of having multiple IPs for your routers so you can do load balancing and redundancy. If you ask them to activate more than one IP, make sure that all of those IPs are assigned to a configured router, they can all be on one router if you don't have multiple routers setup right away. If you told Bell to use multiple IPs but you only have one configured, when one of your customer's routers will start a PPPoE connection, Bell may send the L2TP session to an IP that isn't active, causing that authentication to fail and force your routers to reattempt the session until it hits a router IP that's active. We had that problem initially and certain routers (Most notably the router function of the SmartRG SR505N that Bell offers) would get hung up and require multiple reboots to connect.

I'm using 1492 for the MTU/MRU since that seems to be the default for most DSL modems, keepalive is the default 30. I've created a firewall rule to allow UDP 1701 from the VLAN that Bell gave us for the L2TP sessions.

Anyone using Mikrotik LNS with Bell Canada care to share the L2TP Server Settings? Max MTU and MRU MRRU, Keep Alive Timeout, Authentication type etc.?

Hi Greg,
How did you guys make out with this? Any luck getting things going on your end with the Mikrotik and Bell service? Looks like we're fighting the same battle here!

There's a brief example config in this post: viewtopic.php?f=1&t=26698&start=100#p610418

Bell provided some information to setup the AGAS connection with them, which include an IP you have to assign to your router, static routes and which VLANs you need to use. I put those in as requested. The tunnel password can be configured the way that's in the example config I linked, or if you're also using L2TP for other purposes on the same router (Remote management VPN, ect) like I am, you can take the destination subnet routes that Bell gave you and use them for the "Address" field for the L2TP Secrets. So, if they gave you routes for 1.1.1.1/22 and 2.2.2.2/22, you would put in something like:

Code: Select all

/ppp l2tp-secret
add add address=1.1.1.1/22 secret=TUNNEL-PASSWORD-GOES-HERE
add add address=2.2.2.2/22 secret=TUNNEL-PASSWORD-GOES-HERE

Bell also gives you the option of having multiple IPs for your routers so you can do load balancing and redundancy. If you ask them to activate more than one IP, make sure that all of those IPs are assigned to a configured router, they can all be on one router if you don't have multiple routers setup right away. If you told Bell to use multiple IPs but you only have one configured, when one of your customer's routers will start a PPPoE connection, Bell may send the L2TP session to an IP that isn't active, causing that authentication to fail and force your routers to reattempt the session until it hits a router IP that's active. We had that problem initially and certain routers (Most notably the router function of the SmartRG SR505N that Bell offers) would get hung up and require multiple reboots to connect.

I'm using 1492 for the MTU/MRU since that seems to be the default for most DSL modems, keepalive is the default 30. I've created a firewall rule to allow UDP 1701 from the VLAN that Bell gave us for the L2TP sessions.

This is awesome. Thank you. I’m going to the data centre to move to the Mikrotik and hopefully retire our Cisco this evening. Once it’s all working I’m thinking about providing a working config in this post for others to use.

I am happy to say that our maintenance window went well. I have LNS with Bell Wholesale working perfectly. Had to adjust MTU/MRU in the profile assigned to the L2TP server to 1430. Other than that no major changes.

I have UserManager running in an x86 Mikrotik VM to authenticate users. Also working great.

If there’s any desire to have a config provided for this, I may be willing to share.

We are in the process of taking our Cisco out and would definitely like to see a working config derekb
Would you be kind enough to share?

I am also interested in retiring our old Cisco and replacing it with the Mikrotik.

anybody interested in sending me the full config.... Steak dinner???
I have tidbits of what we need but rather spend the time buying dinner is easier!!!

I am also interested in retiring our old Cisco and replacing it with the Mikrotik.

anybody interested in sending me the full config.... Steak dinner???
I have tidbits of what we need but rather spend the time buying dinner is easier!!!

I like steak, but not from a cheap chain restaurant

Here's a sanitized config I quickly stripped from a CCR we're using with Bell for LNS. You'll have to figure out what to set for your firewall rules and stuff like this. You'll need to know the /29 subnet information for your AHSSPI circuit, the VLAN ID, the L2TP tunnel password, as well as whatever routes Bell wants you to add. I've included the ones we have programmed, but they could potentially be different from what you set on yours. Also, you'll need to know where you're going to send RADIUS request to for the PPP profile setup. In my case, I have UserMan running on an RB1100AHx4 for RADIUS auth. The PPP profile options are going to differ from ours, as we have a very specific use-case for this... you'll likely have a public WAN block you want to dynamically assign to authenticated users. You should be able to figure that out on your own.Also, we have the older Nortel ESU unit from Bell instead of the newer Canoga Perkins unit. Bell hands off as multi-mode fiber and I'm connecting it to combo1 on our CCR.

We are in the process of taking our Cisco out and would definitely like to see a working config derekb
Would you be kind enough to share?

See post above. If you need assistance beyond that, contact me directly and we can work something out.