Community discussions

MUM Europe 2020
 
kinglestat
just joined
Topic Author
Posts: 4
Joined: Thu Nov 10, 2005 4:52 pm

generic ipsec tunnels

Fri Nov 11, 2005 3:50 pm

I have read the documentation ad naseum on ipsec and otherwise, but all examples refer to point-to-point links

I have a situation where I would like the microtik to have a generic setup for multiple ipsec tunnels to it from different manufactureres (eg SMC, Cisco, etc)

How to I create a generic setup on the microtik side, such that a link is created wthout knowing beforehand what the IP is going to be ?
 
User avatar
mag
Member
Member
Posts: 378
Joined: Thu Jul 01, 2004 12:32 pm
Location: Cologne, NRW, Germany
Contact:

Re: generic ipsec tunnels

Sun Nov 13, 2005 2:37 pm

if i understand you correctly, the MT has to be configured as vpn-server in ipsec aggressive-mode. a login with user-id (aka password) is possible then.

sorry to say, i havent't configured this with MT yet, but it works using a few other systems.
 
kinglestat
just joined
Topic Author
Posts: 4
Joined: Thu Nov 10, 2005 4:52 pm

Re: generic ipsec tunnels

Sun Nov 13, 2005 4:43 pm

yes, what you say is right. That is the config I am looking for
do you have any suggestions ?
 
Tonda
Member Candidate
Member Candidate
Posts: 164
Joined: Thu Jun 30, 2005 12:59 pm

Sun Nov 13, 2005 9:19 pm

What is the problem? If you are able to create one point to point IPSec tunnel, then you are able to create more simillar tunnels by adding appropriate IPSec policies, NAT and routing rules.. I think there are also some examples of how to connect MT with other devices (Cisco) in manual..
What do you mean exactly by "generic" setup? Are your clients single computers or other computer networks? Can you be more specific please?
 
User avatar
mag
Member
Member
Posts: 378
Joined: Thu Jul 01, 2004 12:32 pm
Location: Cologne, NRW, Germany
Contact:

Re: generic ipsec tunnels

Mon Nov 14, 2005 2:07 pm

do you have any suggestions ?
sorry, not at the moment, i am working on it.
 
kinglestat
just joined
Topic Author
Posts: 4
Joined: Thu Nov 10, 2005 4:52 pm

Tue Nov 15, 2005 1:59 pm

I have done some testing and have manage to do some progress
I am using the MT l2pserver together with ispec, and MS win 2000 server as a client

MT

/ interface l2tp-server server
set enabled=yes max-mtu=1460 max-mru=1460 authentication=mschap2 \
default-profile=default-encryption


2 address=172.16.13.2/32:57307 secret="JuveIsTheBest" generate-policy=yes
exchange-mode=main send-initial-contact=no proposal-check=claim
hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d
lifebytes=0

3 address=172.16.13.2/32:57307 secret="JuveIsTheBest" generate-policy=yes
exchange-mode=main send-initial-contact=no proposal-check=claim
hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d
lifebytes=0

I src-address=192.168.0.0/23:any dst-address=192.168.2.0/24:any protocol=all
action=encrypt level=require ipsec-protocols=ah,esp tunnel=yes
sa-src-address=172.16.13.1 sa-dst-address=172.16.13.2 proposal=default
manual-sa=EHL dont-fragment=inherit



It seems that negotiation starts as from the log things seem to happen
but after it gives me phase 1 time out
 
User avatar
Eugene
Forum Veteran
Forum Veteran
Posts: 993
Joined: Mon May 31, 2004 5:06 pm
Location: Cranfield, UK

Thu Nov 17, 2005 7:21 pm

For this setup you need working l2tp server and an entry in /ip ipsec peer with generate-policy=yes. No other configuration is needed.
Tout individu a droit à la vie, à la liberté et à la sûreté de sa personne.

Who is online

Users browsing this forum: flohman, ks4312, mur and 84 guests