[Mikrotik] MikroTik IPSec/L2TP and RouterOS v6

2014-01-21 Thread Scott Lambert
I appologize for the length of this e-mail. I didn't want to leave out any of the work I've already done trying to troubleshoot this. I really appreciate anyone willing to slog through it. I am having fits with my IPSect/L2TP VPNs I use to get into various places. Someone posted a recipe to thi

Re: [Mikrotik] MikroTik IPSec/L2TP and RouterOS v6

2014-01-22 Thread Rory McCann
I don't use L2TP so I can't provide much insight on your existing config. I did however follow this guide on a test router and was able to make the configuration work as expected: http://www.nasa-security.net/mikrotik/mikrotik-l2tp-with-ipsec/ I'm on 6.7, so this is current. Rory McCann MKAP T

Re: [Mikrotik] MikroTik IPSec/L2TP and RouterOS v6

2014-01-23 Thread Kristian Hoffmann
Not sure if this applies to your configuration, but I recently ran into the same symptom in two similar cases. The short version is, regardless of what the config and logs say, the IPSec packets will have a source IP of the pref-src value for the route matching the IPSec endpoint. Example...

Re: [Mikrotik] MikroTik IPSec/L2TP and RouterOS v6

2014-01-23 Thread Scott Lambert
On Thu, Jan 23, 2014 at 11:09:16AM -0800, Kristian Hoffmann wrote: > Not sure if this applies to your configuration, but I recently ran into > the same symptom in two similar cases. The short version is, regardless > of what the config and logs say, the IPSec packets will have a source IP > of

Re: [Mikrotik] MikroTik IPSec/L2TP and RouterOS v6

2014-01-23 Thread Butch Evans
On 01/24/2014 01:33 AM, Scott Lambert wrote: On Thu, Jan 23, 2014 at 11:09:16AM -0800, Kristian Hoffmann wrote: Not sure if this applies to your configuration, but I recently ran into the same symptom in two similar cases. The short version is, regardless of what the config and logs say, the IP

Re: [Mikrotik] MikroTik IPSec/L2TP and RouterOS v6

2014-01-24 Thread Kristian Hoffmann
On 01/23/2014 11:58 PM, Butch Evans wrote: This is true if you set the "generate policy" option in the IPSec Peer. If you manually configure the policy, you define the source IP to be used as the "SA Src Address" field. While I haven't tried it, I would imagine that some creative policy rou

Re: [Mikrotik] MikroTik IPSec/L2TP and RouterOS v6

2014-01-24 Thread Kristian Hoffmann
On 01/23/2014 11:33 PM, Scott Lambert wrote: On Thu, Jan 23, 2014 at 11:09:16AM -0800, Kristian Hoffmann wrote: Not sure if this applies to your configuration, but I recently ran into the same symptom in two similar cases. The short version is, regardless of what the config and logs say, the IP