April 22, 2017 at 17:49Mikrotik L2TP / IPSec for NAT: ipsec, error failed to pre-process ph2 packet
- Tutorial
When using Mikrotik for NAT (in particular, for any USB GSM modems) in the L2TP / IPSec client mode, some operators in certain modes got a problem with ipsec error, error failed to pre-process ph2 packet.
But with the advent of RoS 6.38, it became possible to deal with the error.
So, the error appears in the usual L2TP client configuration as in the picture:
The main problem is that the IPSec policy used in this setting is nailed and uses ike1. Ike1, in turn, in the implementation of RoS, has a problem when passing NAT without forwarding ports and as an aggravating circumstance: multiple tunnels with l2tp also do not pass through one NAT (and the number of clients on the modem is huge).
You can solve the problem by using IKE2 (and for a bunch of clients for one NAT you need to refuse PSK authorization in favor of RSA Signature), which cannot be configured from the menu above, but you can do the trick: go to the IP -> IPSec menu
Copy the dynamically created peer, and we change the settings in it as shown below:
Namely, we change Exchange Mode to IKE2, in the Encryption tab we configure the necessary encryption settings.
It remains to disable the use of IPSec in the L2TP / IPSec settings.
That's all, the connection rises, encryption works.
But with the advent of RoS 6.38, it became possible to deal with the error.
So, the error appears in the usual L2TP client configuration as in the picture:
The main problem is that the IPSec policy used in this setting is nailed and uses ike1. Ike1, in turn, in the implementation of RoS, has a problem when passing NAT without forwarding ports and as an aggravating circumstance: multiple tunnels with l2tp also do not pass through one NAT (and the number of clients on the modem is huge).
You can solve the problem by using IKE2 (and for a bunch of clients for one NAT you need to refuse PSK authorization in favor of RSA Signature), which cannot be configured from the menu above, but you can do the trick: go to the IP -> IPSec menu
Copy the dynamically created peer, and we change the settings in it as shown below:
Namely, we change Exchange Mode to IKE2, in the Encryption tab we configure the necessary encryption settings.
It remains to disable the use of IPSec in the L2TP / IPSec settings.
That's all, the connection rises, encryption works.
