Mikrotik as ikev1 VPN Client

creited · Tue Aug 16, 2022 2:46 am

Hi,

I am able to use ShrewSoft as a VPN client in windows and linux.

I am looking into using my mikrotik router to "dial" to this VPN server for better integration with my office.

I could find several tutorials where people teach how to connect ShrewSoft VPN client to Mikrotik using IPSEC/ikev1

https://wiki.mikrotik.com/wiki/IPSEC_be ... rew_client

, but what I'm trying is the opposite. Reach a server using mikrotik.

I have the following VPN.vpn file (sensitive information hidden):

n:version:4
n:network-ike-port:500
n:network-mtu-size:1380
n:client-addr-auto:1
n:network-natt-port:4500
n:network-natt-rate:15
n:network-frag-size:540
n:network-dpd-enable:1
n:network-notify-enable:1
n:client-banner-enable:1
n:phase1-dhgroup:2
n:phase1-life-secs:86400
n:client-dns-used:0
n:client-dns-auto:1
n:client-dns-suffix-auto:1
n:client-splitdns-used:1
n:client-splitdns-auto:1
n:client-wins-used:1
n:client-wins-auto:1
n:phase2-life-secs:3600
n:phase2-life-kbytes:0
n:policy-nailed:0
n:policy-list-auto:0
n:phase1-life-kbytes:0
n:vendor-chkpt-enable:0
s:network-host:192.168.0.10
s:client-auto-mode:pull
s:client-iface:virtual
s:network-natt-mode:enable
s:network-frag-mode:disable
s:auth-method:mutual-psk-xauth
s:ident-client-type:keyid
s:ident-server-type:any
s:ident-client-data:password
b:auth-mutual-psk:AAAAAAAAAAAAAAAAAAAAAAAA=
s:phase1-exchange:aggressive
s:phase1-cipher:auto
s:phase1-hash:auto
s:phase2-transform:auto
s:phase2-hmac:auto
s:ipcomp-transform:disabled
n:phase2-pfsgroup:0
s:policy-level:auto
s:policy-list-include:172.16.0.0 / 255.255.0.0

Do you guys have any hint on how to proceed?

Tks.

sindy · Wed Aug 17, 2022 12:58 pm

Most of the settings can be translated to Mikrotik configuration items, but some of them are not clear to me, and the IKE protocol does not give precise information what exactly was wrong. So worth trying, but the success is not guaranteed.

Start from the following:

/ip ipsec proposal
add auth-algorithms=sha512,sha256,sha1,md5 enc-algorithms=aes-256-cbc,aes-256-ctr,aes-256-gcm,camellia-256,aes-192-cbc,aes-192-ctr,aes-192-gcm,camellia-192,aes-128-cbc,aes-128-ctr,aes-128-gcm,camellia-128,3des,blowfish,twofish,des name=proposal-x pfs-group=none

/ip ipsec policy group
add name=group-x

/ip ipsec policy
add group=group-x template=yes proposal=proposal-x

/ip ipsec profile
add name=profile-x dh-group=modp1024 enc-algorithm=3des,aes-128,aes-192,aes-256,blowfish,camellia-128,camellia-192,camellia-256,des hash-algorithm=md5 (if it fails, you'll have to try with all the other possible hash-algorithm values one by one)

/ip ipsec peer
add name=peer-x profile=profile-x address=ip.of.your.server exchange-mode=aggressive

/ip ipsec mode-config
add name=mode-config-x responder=no

/ip ipsec identity
add peer=peer-x my-id=key-id:password auth-method=pre-shared-key secret="AAAAAAAAAAAAAAAAAAAAAAAA=" generate-policy=port-strict policy-template-group=group-x mode-config=mode-config-x

If /ip ipsec active-peers print doesn't show success, you'll have to activate logging and see at which stage it fails.

creited · Wed Aug 17, 2022 2:38 pm

Hi sindy, thanks for the quick help.

Everything went straightforward.

I followed your steps and I do see a connection under active-peers, but the State is "message 1 sent".

By the way, after loading this config file in my VPN client, I am also requested to enter username and password when dialing. Where can I input these into Mikrotik?

I believe that I'm close to the goal... my logging shows " ipsec IPADDRESS fatal NO-PROPOSAL-CHOSEN notify message, delete phase handle."

Thanks

sindy · Wed Aug 17, 2022 2:54 pm

Everything went straightforward except for /ip ipsec identity mode-config=mode-config-x
Using Winbox this field is named Mode Configuration and the only value allowed is "request-only" or blank.

Wait. You have to create a mode-configuration item, give it a name (mode-config-x) and parameters (responder=no). Once you have done that, it will become available for choice on the "mode-configuration" drop-down in the identity item.

I followed your steps and I do see a connection under active-peers, but the State is "message 1 sent".
...
my logging shows " ipsec IPADDRESS fatal NO-PROPOSAL-CHOSEN notify message, delete phase handle."

That's actually not too good, because it means that the remote peer did not like the settings. Have you tried all the 4 possible values of auth-algorithm in the /ip ipsec profile? Is the resilt (NO-PROPOSAL-CHOSEN) the same for all of them?

By the way, after loading this config file in my VPN client, I am also requested to enter username and password when dialing. Where can I input these into Mikrotik?

That doesn't look well, as it seems you need the pre-shared key and a username/password combination. In the config file, there was "password" as a value for the local ID, and AAA...AAA= as a value for the pre-shared key, which looked as if an individual pre-shared key was chosen for each client, but it is apparently not the case. So you may try to change the auth-method to pre-shared-key-xauth and set the username and password items on the identity row, but it's a blind shot.

creited · Wed Aug 17, 2022 3:13 pm

My bad. I fixed my comment to reflect exactally your tutorial.

I was able to input my username and password, and the only Hash Algorithm that won't lead to a FATAL is sha1 (tested one by one).

I will attach the log when using sha1 as the hash algorithm:

[admin@MikroTik] > 
09:07:51 echo: ipsec,debug 0.0.0.0[500] used as isakmp port (fd=11)
09:07:51 echo: ipsec,debug 0.0.0.0[4500] used as isakmp port with NAT-T (fd=13)
09:07:51 echo: ipsec,debug ::[500] used as isakmp port (fd=14)
09:07:51 echo: ipsec,debug ::[4500] used as isakmp port (fd=15)
[admin@MikroTik] > 
09:07:53 echo: ipsec,debug ===
09:07:53 echo: ipsec,info initiate new phase 1 (Aggressive): 192.168.0.20[500]<=>VPNSERVER.IP[500]
09:07:53 echo: ipsec,debug new cookie:
09:07:53 echo: ipsec,debug a937d779fc659c64
09:07:53 echo: ipsec,debug use ID type of KEY_ID
09:07:53 echo: ipsec,debug dh(modp1024)
[admin@MikroTik] > 
  (79 messages discarded)
09:07:53 echo: ipsec,debug seen nptype=8(hash) len=24
09:07:53 echo: ipsec,debug seen nptype=13(vid) len=20
09:07:53 echo: ipsec,debug seen nptype=13(vid) len=12
09:07:53 echo: ipsec,debug seen nptype=13(vid) len=20
09:07:53 echo: ipsec,debug seen nptype=13(vid) len=20
09:07:53 echo: ipsec,debug seen nptype=20(nat-d) len=24
09:07:53 echo: ipsec,debug seen nptype=20(nat-d) len=24
09:07:53 echo: ipsec,debug seen nptype=13(vid) len=24
09:07:53 echo: ipsec,debug seen nptype=13(vid) len=20
09:07:53 echo: ipsec,debug succeed.
09:07:53 echo: ipsec received Vendor ID: CISCO-UNITY
09:07:53 echo: ipsec,debug,packet f5642d6f 49d4253a 8b1e137e 70d665c4 4e2fc3ef beb819b4 70e98aa2 ce6fee90
[admin@MikroTik] > 
09:07:54 echo: ipsec,debug ===== received 444 bytes from VPNSERVER.IP[500] to 192.168.0.20[500]
09:07:54 echo: ipsec,debug,packet d7029df2 8edebf2f 49298e04 1ad26851 01100400 00000000 000001bc 0400003c
09:07:54 echo: ipsec,debug,packet 00000001 00000001 00000030 01010001 00000028 01010000 80010007 800e0100
09:07:54 echo: ipsec,debug,packet 80020002 80040002 8003fde9 800b0001 000c0004 00015180 0a000084 d6c15398
09:07:54 echo: ipsec,debug,packet 1635eb63 8a5cc54a 0170b95a aa2f7f4c 7a6a8f91 414016ae 115ec823 c39662ac
09:07:54 echo: ipsec,debug,packet b97d85fa 86444c02 977ad425 1194a7b5 f66e4314 844dbe1c 6ebafba0 705a0814
09:07:54 echo: ipsec,debug,packet 5ad4b7e1 94148e21 364434a2 8b032d3e 001a9b6a 495a74ae d2be4570 4c0fcad6
09:07:54 echo: ipsec,debug,packet 33c14f71 d70e20b6 82b46a2b 38b4331e 103d10ce 8f3f7cef 8010c087 05000018
09:07:54 echo: ipsec,debug,packet 5b9a6ee8 8a154677 f9b14eb8 18c7d5eb 6514d1c6 0800000c 01110000 c81101f4
[admin@MikroTik] > 
09:08:00 echo: ipsec,debug KA: 192.168.0.20[4500]->VPNSERVER.IP[4500]
09:08:00 echo: ipsec,debug 1 times of 1 bytes message will be sent to VPNSERVER.IP[4500]
09:08:00 echo: ipsec,debug,packet ff
[admin@MikroTik] > 
  (55 messages discarded)
09:08:01 echo: ipsec,debug type=Group Description, flag=0x8000, lorv=1024-bit MODP group
09:08:01 echo: ipsec,debug dh(modp1024)
09:08:01 echo: ipsec,debug type=Authentication Method, flag=0x8000, lorv=XAuth pskey client
09:08:01 echo: ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
09:08:01 echo: ipsec,debug type=Life Duration, flag=0x0000, lorv=4
09:08:01 echo: ipsec,debug pair 1:
09:08:01 echo: ipsec,debug  0x49bf00: next=0 tnext=0
09:08:01 echo: ipsec,debug proposal #1: 1 transform
09:08:01 echo: ipsec,debug -checking with XAuth pskey client auth-
09:08:01 echo: ipsec,debug prop#=1, prot-id=ISAKMP, spi-size=0, #trns=1
09:08:01 echo: ipsec,debug trns#=1, trns-id=IKE
09:08:01 echo: ipsec,debug,packet compute DH's shared.
[admin@MikroTik] > 
09:08:02 echo: ipsec,debug ===== received 444 bytes from VPNSERVER.IP[500] to 192.168.0.20[500]
09:08:02 echo: ipsec,debug,packet d7029df2 8edebf2f 49298e04 1ad26851 01100400 00000000 000001bc 0400003c
09:08:02 echo: ipsec,debug,packet 00000001 00000001 00000030 01010001 00000028 01010000 80010007 800e0100
09:08:02 echo: ipsec,debug,packet 80020002 80040002 8003fde9 800b0001 000c0004 00015180 0a000084 d6c15398
09:08:02 echo: ipsec,debug,packet 1635eb63 8a5cc54a 0170b95a aa2f7f4c 7a6a8f91 414016ae 115ec823 c39662ac
09:08:02 echo: ipsec,debug,packet b97d85fa 86444c02 977ad425 1194a7b5 f66e4314 844dbe1c 6ebafba0 705a0814
09:08:02 echo: ipsec,debug,packet 5ad4b7e1 94148e21 364434a2 8b032d3e 001a9b6a 495a74ae d2be4570 4c0fcad6
09:08:02 echo: ipsec,debug,packet 33c14f71 d70e20b6 82b46a2b 38b4331e 103d10ce 8f3f7cef 8010c087 05000018
09:08:02 echo: ipsec,debug,packet 5b9a6ee8 8a154677 f9b14eb8 18c7d5eb 6514d1c6 0800000c 01110000 c81101f4
09:08:02 echo: ipsec,debug,packet 0d000018 e35dd478 d3447bc5 5186faad 3db3c1aa 3028faeb 0d000014 12f5f28c
[admin@MikroTik] > 
09:08:03 echo: ipsec,debug 850 bytes from 192.168.0.20[4500] to VPNSERVER.IP[4500]
09:08:03 echo: ipsec,debug 1 times of 854 bytes message will be sent to VPNSERVER.IP[4500]
09:08:03 echo: ipsec,debug,packet a937d779 fc659c64 00000000 00000000 01100400 00000000 00000352 04000174
09:08:03 echo: ipsec,debug,packet 00000001 00000001 00000168 01010009 03000028 01010000 800b0001 000c0004
09:08:03 echo: ipsec,debug,packet 00015180 80010007 800e0100 8003fde9 80020002 80040002 03000028 02010000
09:08:03 echo: ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0100 8003fde9 80020002 80040002
09:08:03 echo: ipsec,debug,packet 03000028 03010000 800b0001 000c0004 00015180 80010007 800e00c0 8003fde9
09:08:03 echo: ipsec,debug,packet 80020002 80040002 03000028 04010000 800b0001 000c0004 00015180 80010008
09:08:03 echo: ipsec,debug,packet 800e00c0 8003fde9 80020002 80040002 03000028 05010000 800b0001 000c0004
09:08:03 echo: ipsec,debug hashtype = SHA:SHA
09:08:03 echo: ipsec,debug,packet hmac(hmac_sha1)
[admin@MikroTik] > 
  (47 messages discarded)
09:08:09 echo: ipsec,debug succeed.
09:08:09 echo: ipsec,debug transform #1 len=40
09:08:09 echo: ipsec,debug type=Encryption Algorithm, flag=0x8000, lorv=AES-CBC
09:08:09 echo: ipsec,debug,packet encryption(aes)
09:08:09 echo: ipsec,debug type=Key Length, flag=0x8000, lorv=256
09:08:09 echo: ipsec,debug type=Hash Algorithm, flag=0x8000, lorv=SHA
09:08:09 echo: ipsec,debug hash(sha1)
09:08:09 echo: ipsec,debug type=Group Description, flag=0x8000, lorv=1024-bit MODP group
09:08:09 echo: ipsec,debug dh(modp1024)
09:08:09 echo: ipsec,debug type=Authentication Method, flag=0x8000, lorv=XAuth pskey client
09:08:09 echo: ipsec,debug type=Life Type, flag=0x8000, lorv=seconds
09:08:09 echo: ipsec,debug,packet compute DH's shared.
[admin@MikroTik] > 
09:08:10 echo: ipsec,debug ===== received 92 bytes from VPNSERVER.IP[500] to 192.168.0.20[500]
09:08:10 echo: ipsec,debug,packet d7029df2 8edebf2f 49298e04 1ad26851 08100501 4c94847c 0000005c 04844c6c
09:08:10 echo: ipsec,debug,packet 63fa8a13 5da13e02 ed3713c0 8d377a25 ebd77b0f 448b8053 0c58d008 c293b5e4
09:08:10 echo: ipsec,debug,packet 97b8e51b 70922313 a78b2fac d3712955 d33cbdd0 05088eeb 6f025a53
09:08:10 echo: ipsec VPNSERVER.IP unknown Informational exchange received.
[admin@MikroTik] > 
  (4 messages discarded)
09:08:11 echo: ipsec,debug,packet 26de847d 5b301e93 e5d7d093 386e7bed 308b32cb 9dd54dc0 4391de16 806d5c5b
09:08:11 echo: ipsec,debug,packet a4b303e0 44f0644f ac4df305 ac5a9d43 afa98111 4ed02092 da14b44a ae6b3d69
09:08:11 echo: ipsec,debug,packet 6052f053 b82177c0 14bd8b76 df380317 7c949b6b b07d4188 f46f7409 66d20c96
09:08:11 echo: ipsec,debug,packet 7bb91de3 9ab03556 0b5cd012 4dd03841 b139f19d f03ec068 0bda2a3a 05000018
09:08:11 echo: ipsec,debug,packet 4dcc2f88 7917c7be 15affb38 09743db0 22af7ac6 0800000c 01110000 c81101f4
09:08:11 echo: ipsec,debug,packet 0d000018 f4fe8aab 06bb3700 55a7afbd 0f008fc5 02de2d3e 0d000014 12f5f28c
09:08:11 echo: ipsec,debug,packet 457168a9 702d9fe2 74cc0100 0d00000c 09002689 dfd6b712 0d000014 afcad713
09:08:11 echo: ipsec,debug,packet 68a1f1c9 6b8696fc 77570100 14000014 4a131c81 07035845 5c5728f2 0e95452f
09:08:11 echo: ipsec,debug,packet 14000018 c2c110d8 d8e92a38 95be47b5 ea249619 bba6b300 0d000018 631841e0
09:08:11 echo: ipsec,debug,packet a3c1864d 44d55b12 d142db4b b78fcd37 0d000018 4048b7d5 6ebce885 25e7de7f
09:08:11 echo: ipsec,debug,packet compute DH's shared.
09:08:11 echo: ipsec,debug,packet bcdecfb2 dfcde4ee 2e783688 dbfa11fd a4b9bc83 637bf6ba 2d0ecc09 03830cb3
[admin@MikroTik] > 
  (7 messages discarded)
09:08:13 echo: ipsec,debug,packet 80020002 80040002 03000028 04010000 800b0001 000c0004 00015180 80010008
09:08:13 echo: ipsec,debug,packet 800e00c0 8003fde9 80020002 80040002 03000028 05010000 800b0001 000c0004
09:08:13 echo: ipsec,debug,packet 00015180 80010007 800e0080 8003fde9 80020002 80040002 03000028 06010000
09:08:13 echo: ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0080 8003fde9 80020002 80040002
09:08:13 echo: ipsec,debug,packet 03000024 07010000 800b0001 000c0004 00015180 80010005 8003fde9 80020002
09:08:13 echo: ipsec,debug,packet 80040002 03000028 08010000 800b0001 000c0004 00015180 80010003 800e0080
09:08:13 echo: ipsec,debug,packet 8003fde9 80020002 80040002 00000024 09010000 800b0001 000c0004 00015180
09:08:13 echo: ipsec,debug,packet 80010001 8003fde9 80020002 80040002 0a000084 be870ea5 cd5be2b5 51f04cd1
09:08:13 echo: ipsec,debug,packet b61ea739 d53d6391 3ad36976 49befc36 af1cbe3c 23773db8 c8dac539 0e10c7f0
09:08:13 echo: ipsec,debug,packet a5c53c7b 61e86571 1f3dcc75 cce1af84 da0a5319 757ffafc c2062a74 ef9f0799
09:08:13 echo: ipsec,debug,packet 69719ffb 540ac5e1 54fa38c1 ba5e0293 ee5b1fce bcdecfb2 dfcde4ee 2e783688
09:08:13 echo: ipsec,debug,packet 000c0900 2689dfd6 b7120d00 001412f5 f28c4571 68a9702d 9fe274cc 01000000
[admin@MikroTik] > 
  (28 messages discarded)
09:08:17 echo: ipsec,debug seen nptype=13(vid) len=20
09:08:17 echo: ipsec,debug succeed.
09:08:17 echo: ipsec received Vendor ID: CISCO-UNITY
09:08:17 echo: ipsec received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt
09:08:17 echo: ipsec received Vendor ID: DPD
09:08:17 echo: ipsec,debug remote supports DPD
09:08:17 echo: ipsec received Vendor ID: RFC 3947
09:08:17 echo: ipsec received Vendor ID: FRAGMENTATION
09:08:17 echo: ipsec,debug received unknown Vendor ID
09:08:17 echo: ipsec,debug 1f07f70e aa6514d3 b0fa9654 2a500100
09:08:17 echo: ipsec,debug total SA len=56
09:08:17 echo: ipsec,debug,packet compute DH's shared.
[admin@MikroTik] > 
  (8 messages discarded)
09:08:19 echo: ipsec,debug,packet 4dcc2f88 7917c7be 15affb38 09743db0 22af7ac6 0800000c 01110000 c81101f4
09:08:19 echo: ipsec,debug,packet 0d000018 f4fe8aab 06bb3700 55a7afbd 0f008fc5 02de2d3e 0d000014 12f5f28c
09:08:19 echo: ipsec,debug,packet 457168a9 702d9fe2 74cc0100 0d00000c 09002689 dfd6b712 0d000014 afcad713
09:08:19 echo: ipsec,debug,packet 68a1f1c9 6b8696fc 77570100 14000014 4a131c81 07035845 5c5728f2 0e95452f
09:08:19 echo: ipsec,debug,packet 14000018 c2c110d8 d8e92a38 95be47b5 ea249619 bba6b300 0d000018 631841e0
09:08:19 echo: ipsec,debug,packet a3c1864d 44d55b12 d142db4b b78fcd37 0d000018 4048b7d5 6ebce885 25e7de7f
09:08:19 echo: ipsec,debug,packet 00d6c2d3 c0000000 00000014 1f07f70e aa6514d3 b0fa9654 2a500100
09:08:19 echo: ipsec,debug begin.
09:08:19 echo: ipsec,debug seen nptype=1(sa) len=60
09:08:19 echo: ipsec,debug seen nptype=4(ke) len=132
09:08:19 echo: ipsec,debug seen nptype=10(nonce) len=24
09:08:19 echo: ipsec,debug,packet compute DH's shared.
[admin@MikroTik] > 
09:08:19 echo: ipsec,debug,packet 80020002 80040002 03000028 02010000 800b0001 000c0004 00015180 80010008
[admin@MikroTik] > 
09:08:20 echo: ipsec,debug KA: 192.168.0.20[4500]->VPNSERVER.IP[4500]
09:08:20 echo: ipsec,debug 1 times of 1 bytes message will be sent to VPNSERVER.IP[4500]
09:08:20 echo: ipsec,debug,packet ff
[admin@MikroTik] > 
  (18 messages discarded)
09:08:23 echo: ipsec,debug,packet dbfa11fd a4b9bc83 637bf6ba 2d0ecc09 03830cb3 0500001c f1b833af f24c64f0
09:08:23 echo: ipsec,debug,packet 0158c401 22c3d792 e03391a2 24cd1d95 0d000012 0b000000 74656c65 6d617469
09:08:23 echo: ipsec,debug,packet 63610d00 00144a13 1c810703 58455c57 28f20e95 452f0d00 00148f8d 83826d24
09:08:23 echo: ipsec,debug,packet 6b6fc7a8 a6a428c1 1de80d00 0014439b 59f8ba67 6c4c7737 ae22eab8 f5820d00
09:08:23 echo: ipsec,debug,packet 00144d1e 0e136dea fa34c4f3 ea9f02ec 72850d00 001480d0 bb3def54 565ee846
09:08:23 echo: ipsec,debug,packet 45d4c85c e3ee0d00 00149909 b64eed93 7c6573de 52ace952 fa6b0d00 00147d94
09:08:23 echo: ipsec,debug,packet 19a65310 ca6f2c17 9d921552 9d560d00 0014cd60 464335df 21f87cfd b2fc68b6
09:08:23 echo: ipsec,debug,packet a4480d00 001490cb 80913ebb 696e0863 81b5ec42 7b1f0d00 001416f6 ca16e4a4
09:08:23 echo: ipsec,debug,packet 066d8382 1a0f0aea a8620d00 00144485 152d18b6 bbcd0be8 a8469579 ddcc0d00
09:08:23 echo: ipsec,debug,packet 000c0900 2689dfd6 b7120d00 001412f5 f28c4571 68a9702d 9fe274cc 01000000
09:08:23 echo: ipsec,debug,packet 0014afca d71368a1 f1c96b86 96fc7757 0100
09:08:23 echo: ipsec resent phase1 packet 192.168.0.20[4500]<=>VPNSERVER.IP[4500] a937d779fc659c64:7ef459457352800e
[admin@MikroTik] > 
  (12 messages discarded)
09:08:25 echo: ipsec,debug,packet 1ca72288 70435125 fd56c0f6 4b2e89c2
09:08:25 echo: ipsec,debug,packet encryption(aes)
09:08:25 echo: ipsec,debug,packet IV was saved for next processing:
09:08:25 echo: ipsec,debug,packet f4eedec5 f6da55fc c44f9c01 f03efb14
09:08:25 echo: ipsec,debug,packet encryption(aes)
09:08:25 echo: ipsec,debug,packet with key:
09:08:25 echo: ipsec,debug,packet a6b95b70 4b87636f 861d94b8 c64dd90a 138d7657 7fab7bb8 b50529e4 037dbb31
09:08:25 echo: ipsec,debug,packet decrypted payload by IV:
09:08:25 echo: ipsec,debug,packet 1ca72288 70435125 fd56c0f6 4b2e89c2
09:08:25 echo: ipsec,debug,packet decrypted payload, but not trimed.
09:08:25 echo: ipsec,debug,packet d887c687 30928ce1 e2113ad1 755dcac4 486809b7 485b19d0 040dfb8d ce38a55e
09:08:25 echo: ipsec,debug,packet 8ac7211f f516395a 12459987 73ba5b2c 87e1d39c 1f74d3d4 fd9bca0a 8997d6a6
[admin@MikroTik] > 
  (11 messages discarded)
09:08:27 echo: ipsec,debug,packet 68a1f1c9 6b8696fc 77570100 14000014 4a131c81 07035845 5c5728f2 0e95452f
09:08:27 echo: ipsec,debug,packet 14000018 c2c110d8 d8e92a38 95be47b5 ea249619 bba6b300 0d000018 631841e0
09:08:27 echo: ipsec,debug,packet a3c1864d 44d55b12 d142db4b b78fcd37 0d000018 4048b7d5 6ebce885 25e7de7f
09:08:27 echo: ipsec,debug,packet 00d6c2d3 c0000000 00000014 1f07f70e aa6514d3 b0fa9654 2a500100
09:08:27 echo: ipsec,debug begin.
09:08:27 echo: ipsec,debug seen nptype=1(sa) len=60
09:08:27 echo: ipsec,debug seen nptype=4(ke) len=132
09:08:27 echo: ipsec,debug seen nptype=10(nonce) len=24
09:08:27 echo: ipsec,debug seen nptype=5(id) len=12
09:08:27 echo: ipsec,debug seen nptype=8(hash) len=24
09:08:27 echo: ipsec,debug,packet compute DH's shared.
09:08:27 echo: ipsec,debug,packet 00015180 80010005 8003fde9 80020002 80040002 03000028 08010000 800b0001
[admin@MikroTik] > 
09:08:31 echo: ipsec,debug Removing PH1...
09:08:31 echo: ipsec,info ISAKMP-SA deleted 192.168.0.20[4500]-VPNSERVER.IP[4500] spi:a937d779fc659c64:7ef459457352800e rekey:1
09:08:31 echo: ipsec KA remove: 192.168.0.20[4500]->VPNSERVER.IP[4500]
09:08:31 echo: ipsec,debug KA tree dump: 192.168.0.20[4500]->VPNSERVER.IP[4500] (in_use=1)
09:08:31 echo: ipsec,debug KA removing this one...

Thanks

sindy · Wed Aug 17, 2022 3:22 pm

Disable the peer, run /log print follow-only file=ipsec-start where topics~"ipsec", enable the peer, give it 30 seconds, and break (Ctrl-C) the /log print .... Then download the ipsec-start.txt. But if it is the old, long unsupported Cisco VPN (where the WIndows client relies on unsupported components and only Shrewsoft can handle it), something is telling me there was an unresolvable issue with connecting a Mikrotik initiator to it.

creited · Wed Aug 17, 2022 3:32 pm

Understood...

I tried twice to make sure that the authkey and user/password are correct and all I see is:

# aug/17/2022  9:29:57 by RouterOS 7.2.3
# software id = XXXX-XXXX
#
09:30:02 ipsec,info initiate new phase 1 (Aggressive): 192.168.0.20[500]<=>VPN.IP[500] 
09:30:06 ipsec,error HASH mismatched 
09:30:06 ipsec,error possible cause: wrong password 
09:30:13 ipsec,error HASH mismatched 
09:30:13 ipsec,error possible cause: wrong password 
09:30:15 ipsec,error HASH mismatched 
09:30:15 ipsec,error possible cause: wrong password 
09:30:21 ipsec,error HASH mismatched 
09:30:21 ipsec,error possible cause: wrong password 
09:30:23 ipsec,error HASH mismatched 
09:30:23 ipsec,error possible cause: wrong password 
09:30:29 ipsec,error HASH mismatched 
09:30:29 ipsec,error possible cause: wrong password 
09:30:31 ipsec,error HASH mismatched 
09:30:31 ipsec,error possible cause: wrong password 
09:30:39 ipsec,error HASH mismatched 
09:30:39 ipsec,error possible cause: wrong password

sindy · Wed Aug 17, 2022 5:32 pm

I think (I didn't go through the RFC) that the hash is not computed only from the password, so check also the username, but other than that, I'm afraid that's it.

creited · Wed Aug 17, 2022 6:38 pm

Thanks sindy.

I checked the credentials inserted with winbox and they are correct. Unfortunaltely no evolution from this point.

Anyway thanks for your help.

Mikrotik as ikev1 VPN Client

Mikrotik as ikev1 VPN Client

Re: Mikrotik as ikev1 VPN Client

Re: Mikrotik as ikev1 VPN Client

Re: Mikrotik as ikev1 VPN Client

Re: Mikrotik as ikev1 VPN Client

Re: Mikrotik as ikev1 VPN Client

Re: Mikrotik as ikev1 VPN Client

Re: Mikrotik as ikev1 VPN Client

Re: Mikrotik as ikev1 VPN Client

Who is online