转自: http://www.firstdigest.com/2015/01/mikrotik-l2tp-with-ipsec-for-mobile-clients/
1.Add a new pool
GUI IP > Pool Name: L2TP-Pool Adresses: 172.31.86.1-172.31.86.14 Next Pool: None CLI /ip pool add name="L2TP-Pool" ranges=172.31.86.1-172.31.86.14 |
L2TP Configuration
1. Configure L2TP Profile
GUI PPP > Profiles Name: l2tp-profile Local Address: L2TP-Pool Remote Address: L2TP-Pool DNS Server: 8.8.8.8 Change TCP MSS: yes Use Encryption: required CLI /ppp profile add name=l2tp-profile local-address=L2TP-Pool remote-address=L2TP-Pool use-encryption=required change-tcp-mss=yes dns-server=8.8.8.8 |
2. Add a L2TP-Server
GUI PPP > Interface > L2TP Server Enabled: Checked Max MTU: 1460 Max MRU: 1460 Keepalive Timeout: 30 Default Profile: mschap2 Use IPsec: Checked IPsec Secret: MYKEY CLI /interface l2tp-server server set authentication=mschap2 default-profile=l2tp-profile enabled=yes ipsec-secret=MYKEY max-mru=1460 max-mtu=1460 use-ipsec=yes |
3. Add PPP Secrets
GUI PPP > Secrets Enabled: Checked Name: MYUSER Password: MYPASSWORD Service: l2tp Profile: l2tp-profile CLI /ppp secret add name=MYUSER password=MYPASSWORD service=l2tp profile=l2tp-profile |
IPsec Configuration
1. IPsec Proposals
GUI IPsec > Proposals Enabled: Checked Name: L2TP-Proposal Auth. Algorithm: sha1 Encr. Algorithm: 3des, aes-256 cbc PFS Group: none CLI /ip ipsec proposal add name=L2TP-Proposal auth-algorithms=sha1 enc-algorithms=3des,aes-256-cbc pfs-group=none |
2. IPsec Peers
GUI IPsec > Peers Enabled: Checked Address: 0.0.0.0 Auth. Method: pre shared key Secret: MYKEY Policy Template Group: default Exchange Mode: main l2tp Send Initial Contact: Checked NAT Traversal: Checked My ID: auto Proposal check: obey Hash Algorithm: sha1 Encryption Algorithm: 3des, aes-256 DH Group: modp1024 Generate policy: port override CLI /ip ipsec peer add address=0.0.0.0/0 port=500 auth-method=pre-shared-key secret="MYKEY" generate-policy=port-override exchange-mode=main-l2tp send-initial-contact=yes nat-traversal=yes hash-algorithm=sha1 enc-algorithm=3des,aes-256 dh-group=modp1024 |
3. IPsec Policies
GUI Enabled: Checked Src. Address: ::/0 Dst. Address: ::/0 Protocol: 255(all) Template: Checked Group: default Action: encrypt Level: require IPsec Protocols: esp Tunnel: Not checked SA Src. Address: 0.0.0.0 SA Dsr. Address: 0.0.0.0 Proposal: L2TP-Proposal CLI /ip ipsec policy add src-address=::/0 dst-address=::/0 protocol=all template=yes group=default action=encrypt level=require ipsec-protocols=esp tunnel=no sa-src-address=0.0.0.0 sa-dst-address=0.0.0.0 proposal=L2TP-Proposal |
PS：
因为同事们在家里连国外的VPN不太稳，所以用它从园区分给公司的IP上绕一绕。
具体可见之前发的那贴： http://yemaosheng.com/?p=1587