Community discussions

MikroTik App
  4. RouterOS
  5. General

IPSec Xauth PSK client-to-site?  [SOLVED]

Post Reply
 
td32
Member Candidate
Member Candidate
Topic Author
Posts: 112
Joined: Fri Nov 18, 2016 5:55 am

IPSec Xauth PSK client-to-site?

Mon May 01, 2017 4:08 pm

Hello
I have the following details from the Cisco vpn
Code: Select all
IPSec Xauth PSK
ip: x.x.x.x
group: groupID
secret: Pass2

user: user1
pass: pass1
I can set this up fine on my phone and it connects easily.

I tried to connect my mikrorik router as a client to the cisco vpn and route all the mikrotik clients traffic through this vpn.
I enabled ipsec logging and this is the error i get
Image

here is the ipsec config on the mikrotik
Code: Select all
[admin@MikroTik] /ip ipsec peer> print
Flags: X - disabled, D - dynamic, R - responder 
 0 X   address=x.x.x.x/32 local-address=192.168.y.y(wan IP) 
       auth-method=pre-shared-key-xauth secret="Pass2" 
       xauth-login="user1" xauth-password="pass1" 
       generate-policy=port-strict policy-template-group=default 
       exchange-mode=main mode-config=request-only send-initial-contact=yes 
       nat-traversal=yes proposal-check=obey 
       compatibility-options=skip-peer-id-validation hash-algorithm=sha1 
       enc-algorithm=aes-256,aes-192,aes-128,3des dh-group=modp1024 
       lifetime=1d dpd-interval=2m dpd-maximum-failures=5
Code: Select all
[admin@MikroTik] > ip ipsec proposal print
Flags: X - disabled, * - default 
 0  * name="default" auth-algorithms=sha1,md5 
      enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des lifetime=30m 
      pfs-group=modp1024 

 1    name="proposal1" auth-algorithms=sha1 
      enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des lifetime=0s 
      pfs-group=none
mikrotik wan interface has not a public ip(192.168.y.y), its located after a NAT router.
Can this be done this way?
Top
 
td32
Member Candidate
Member Candidate
Topic Author
Posts: 112
Joined: Fri Nov 18, 2016 5:55 am

Re: IPSec Xauth PSK client-to-site?

Tue May 02, 2017 1:03 pm

Anyone had luck with this type of configuration.
I have read the other topics in here about IPSec Xauth PSK on cisco but they provide no final conclusion if it is supported or not.
viewtopic.php?t=92819
Top
 
td32
Member Candidate
Member Candidate
Topic Author
Posts: 112
Joined: Fri Nov 18, 2016 5:55 am

Re: IPSec Xauth PSK client-to-site?

Fri Mar 01, 2019 1:55 am

i'm bumping this once again
Anyone has any idea if this can be done?
does ROS support IPSec Xauth PSK client-to-site with a cisco router?
Top
 
User avatar
emils
Forum Veteran
Forum Veteran
Posts: 906
Joined: Thu Dec 11, 2014 8:53 am

Re: IPSec Xauth PSK client-to-site?  [SOLVED]

Fri Mar 01, 2019 12:07 pm

Post full IPsec debug logs. If I recall correctly, you have to use my-id=key-id when connecting to cisco XAuth server.
Top
 
td32
Member Candidate
Member Candidate
Topic Author
Posts: 112
Joined: Fri Nov 18, 2016 5:55 am

Re: IPSec Xauth PSK client-to-site?

Sat Mar 02, 2019 1:26 am

Code: Select all
# mar/02/2019 00:22:06 by RouterOS 6.42.12
/ip ipsec policy group
set [ find default=yes ] name=groupID
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha512,sha256,sha1,md5 \
    enc-algorithms=aes-256-cbc,aes-256-ctr,aes-256-gcm,3des pfs-group=none
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc,aes-192-cbc name=\
    proposal-H
/ip ipsec peer
add address=ciscoIP.10/32 auth-method=pre-shared-key-xauth \
    compatibility-options=skip-peer-id-validation dh-group="ecp256,ecp384,ecp5\
    21,ec2n185,ec2n155,modp8192,modp6144,modp4096,modp3072,modp2048,modp1536,m\
    odp1024,modp768" disabled=yes enc-algorithm="aes-256,camellia-256,aes-192,\
    camellia-192,aes-128,camellia-128,3des,blowfish,des" exchange-mode=\
    main-l2tp hash-algorithm=md5 my-id=key-id nat-traversal=no \
    proposal-check=claim secret=Pass2 send-initial-contact=no \
    xauth-login=user1 xauth-password=pass1
log
Code: Select all
# mar/ 2/2019  0:12:51 by RouterOS 6.42.12
#
mar/02 00:12:16 ipsec,debug === 
mar/02 00:12:16 ipsec,info initiate new phase 1 (Identity Protection): MikrotikIP.241[500]<=>ciscoIP.10[500] 
mar/02 00:12:16 ipsec,debug new cookie: 
mar/02 00:12:16 ipsec,debug 8d8ce4832f371fcb 
mar/02 00:12:16 ipsec,debug add payload of len 4592, next type 13 
mar/02 00:12:16 ipsec,debug add payload of len 8, next type 13 
mar/02 00:12:16 ipsec,debug add payload of len 16, next type 13 
mar/02 00:12:16 ipsec,debug add payload of len 16, next type 0 
mar/02 00:12:16 ipsec,debug 4676 bytes from MikrotikIP.241[500] to ciscoIP.10[500] 
mar/02 00:12:16 ipsec,debug 1 times of 4676 bytes message will be sent to ciscoIP.10[500] 
mar/02 00:12:16 ipsec,debug,packet 8d8ce483 2f371fcb 00000000 00000000 01100200 00000000 00001244 0d0011f4 
mar/02 00:12:16 ipsec,debug,packet 00000001 00000001 000011e8 01010075 03000028 01010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e0100 8003fde9 80020001 80040015 03000028 02010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010007 800e0100 8003fde9 80020001 80040014 
mar/02 00:12:16 ipsec,debug,packet 03000028 03010000 800b0001 000c0004 00015180 80010007 800e0100 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040013 03000028 04010000 800b0001 000c0004 00015180 80010007 
mar/02 00:12:16 ipsec,debug,packet 800e0100 8003fde9 80020001 80040004 03000028 05010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e0100 8003fde9 80020001 80040003 03000028 06010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010007 800e0100 8003fde9 80020001 80040012 
mar/02 00:12:16 ipsec,debug,packet 03000028 07010000 800b0001 000c0004 00015180 80010007 800e0100 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040011 03000028 08010000 800b0001 000c0004 00015180 80010007 
mar/02 00:12:16 ipsec,debug,packet 800e0100 8003fde9 80020001 80040010 03000028 09010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e0100 8003fde9 80020001 8004000f 03000028 0a010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010007 800e0100 8003fde9 80020001 8004000e 
mar/02 00:12:16 ipsec,debug,packet 03000028 0b010000 800b0001 000c0004 00015180 80010007 800e0100 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040005 03000028 0c010000 800b0001 000c0004 00015180 80010007 
mar/02 00:12:16 ipsec,debug,packet 800e0100 8003fde9 80020001 80040002 03000028 0d010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e0100 8003fde9 80020001 80040001 03000028 0e010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0100 8003fde9 80020001 80040015 
mar/02 00:12:16 ipsec,debug,packet 03000028 0f010000 800b0001 000c0004 00015180 80010008 800e0100 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040014 03000028 10010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e0100 8003fde9 80020001 80040013 03000028 11010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010008 800e0100 8003fde9 80020001 80040004 03000028 12010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0100 8003fde9 80020001 80040003 
mar/02 00:12:16 ipsec,debug,packet 03000028 13010000 800b0001 000c0004 00015180 80010008 800e0100 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040012 03000028 14010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e0100 8003fde9 80020001 80040011 03000028 15010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010008 800e0100 8003fde9 80020001 80040010 03000028 16010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0100 8003fde9 80020001 8004000f 
mar/02 00:12:16 ipsec,debug,packet 03000028 17010000 800b0001 000c0004 00015180 80010008 800e0100 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 8004000e 03000028 18010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e0100 8003fde9 80020001 80040005 03000028 19010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010008 800e0100 8003fde9 80020001 80040002 03000028 1a010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0100 8003fde9 80020001 80040001 
mar/02 00:12:16 ipsec,debug,packet 03000028 1b010000 800b0001 000c0004 00015180 80010007 800e00c0 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040015 03000028 1c010000 800b0001 000c0004 00015180 80010007 
mar/02 00:12:16 ipsec,debug,packet 800e00c0 8003fde9 80020001 80040014 03000028 1d010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e00c0 8003fde9 80020001 80040013 03000028 1e010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010007 800e00c0 8003fde9 80020001 80040004 
mar/02 00:12:16 ipsec,debug,packet 03000028 1f010000 800b0001 000c0004 00015180 80010007 800e00c0 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040003 03000028 20010000 800b0001 000c0004 00015180 80010007 
mar/02 00:12:16 ipsec,debug,packet 800e00c0 8003fde9 80020001 80040012 03000028 21010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e00c0 8003fde9 80020001 80040011 03000028 22010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010007 800e00c0 8003fde9 80020001 80040010 
mar/02 00:12:16 ipsec,debug,packet 03000028 23010000 800b0001 000c0004 00015180 80010007 800e00c0 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 8004000f 03000028 24010000 800b0001 000c0004 00015180 80010007 
mar/02 00:12:16 ipsec,debug,packet 800e00c0 8003fde9 80020001 8004000e 03000028 25010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e00c0 8003fde9 80020001 80040005 03000028 26010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010007 800e00c0 8003fde9 80020001 80040002 
mar/02 00:12:16 ipsec,debug,packet 03000028 27010000 800b0001 000c0004 00015180 80010007 800e00c0 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040001 03000028 28010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e00c0 8003fde9 80020001 80040015 03000028 29010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010008 800e00c0 8003fde9 80020001 80040014 03000028 2a010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e00c0 8003fde9 80020001 80040013 
mar/02 00:12:16 ipsec,debug,packet 03000028 2b010000 800b0001 000c0004 00015180 80010008 800e00c0 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040004 03000028 2c010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e00c0 8003fde9 80020001 80040003 03000028 2d010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010008 800e00c0 8003fde9 80020001 80040012 03000028 2e010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e00c0 8003fde9 80020001 80040011 
mar/02 00:12:16 ipsec,debug,packet 03000028 2f010000 800b0001 000c0004 00015180 80010008 800e00c0 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040010 03000028 30010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e00c0 8003fde9 80020001 8004000f 03000028 31010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010008 800e00c0 8003fde9 80020001 8004000e 03000028 32010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e00c0 8003fde9 80020001 80040005 
mar/02 00:12:16 ipsec,debug,packet 03000028 33010000 800b0001 000c0004 00015180 80010008 800e00c0 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040002 03000028 34010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e00c0 8003fde9 80020001 80040001 03000028 35010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e0080 8003fde9 80020001 80040015 03000028 36010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010007 800e0080 8003fde9 80020001 80040014 
mar/02 00:12:16 ipsec,debug,packet 03000028 37010000 800b0001 000c0004 00015180 80010007 800e0080 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040013 03000028 38010000 800b0001 000c0004 00015180 80010007 
mar/02 00:12:16 ipsec,debug,packet 800e0080 8003fde9 80020001 80040004 03000028 39010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e0080 8003fde9 80020001 80040003 03000028 3a010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010007 800e0080 8003fde9 80020001 80040012 
mar/02 00:12:16 ipsec,debug,packet 03000028 3b010000 800b0001 000c0004 00015180 80010007 800e0080 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040011 03000028 3c010000 800b0001 000c0004 00015180 80010007 
mar/02 00:12:16 ipsec,debug,packet 800e0080 8003fde9 80020001 80040010 03000028 3d010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e0080 8003fde9 80020001 8004000f 03000028 3e010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010007 800e0080 8003fde9 80020001 8004000e 
mar/02 00:12:16 ipsec,debug,packet 03000028 3f010000 800b0001 000c0004 00015180 80010007 800e0080 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040005 03000028 40010000 800b0001 000c0004 00015180 80010007 
mar/02 00:12:16 ipsec,debug,packet 800e0080 8003fde9 80020001 80040002 03000028 41010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010007 800e0080 8003fde9 80020001 80040001 03000028 42010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0080 8003fde9 80020001 80040015 
mar/02 00:12:16 ipsec,debug,packet 03000028 43010000 800b0001 000c0004 00015180 80010008 800e0080 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040014 03000028 44010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e0080 8003fde9 80020001 80040013 03000028 45010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010008 800e0080 8003fde9 80020001 80040004 03000028 46010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0080 8003fde9 80020001 80040003 
mar/02 00:12:16 ipsec,debug,packet 03000028 47010000 800b0001 000c0004 00015180 80010008 800e0080 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040012 03000028 48010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e0080 8003fde9 80020001 80040011 03000028 49010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010008 800e0080 8003fde9 80020001 80040010 03000028 4a010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0080 8003fde9 80020001 8004000f 
mar/02 00:12:16 ipsec,debug,packet 03000028 4b010000 800b0001 000c0004 00015180 80010008 800e0080 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 8004000e 03000028 4c010000 800b0001 000c0004 00015180 80010008 
mar/02 00:12:16 ipsec,debug,packet 800e0080 8003fde9 80020001 80040005 03000028 4d010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010008 800e0080 8003fde9 80020001 80040002 03000028 4e010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010008 800e0080 8003fde9 80020001 80040001 
mar/02 00:12:16 ipsec,debug,packet 03000024 4f010000 800b0001 000c0004 00015180 80010005 8003fde9 80020001 
mar/02 00:12:16 ipsec,debug,packet 80040015 03000024 50010000 800b0001 000c0004 00015180 80010005 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040014 03000024 51010000 800b0001 000c0004 00015180 80010005 
mar/02 00:12:16 ipsec,debug,packet 8003fde9 80020001 80040013 03000024 52010000 800b0001 000c0004 00015180 
mar/02 00:12:16 ipsec,debug,packet 80010005 8003fde9 80020001 80040004 03000024 53010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010005 8003fde9 80020001 80040003 03000024 54010000 800b0001 
mar/02 00:12:16 ipsec,debug,packet 000c0004 00015180 80010005 8003fde9 80020001 80040012 03000024 55010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010005 8003fde9 80020001 80040011 03000024 
mar/02 00:12:16 ipsec,debug,packet 56010000 800b0001 000c0004 00015180 80010005 8003fde9 80020001 80040010 
mar/02 00:12:16 ipsec,debug,packet 03000024 57010000 800b0001 000c0004 00015180 80010005 8003fde9 80020001 
mar/02 00:12:16 ipsec,debug,packet 8004000f 03000024 58010000 800b0001 000c0004 00015180 80010005 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 8004000e 03000024 59010000 800b0001 000c0004 00015180 80010005 
mar/02 00:12:16 ipsec,debug,packet 8003fde9 80020001 80040005 03000024 5a010000 800b0001 000c0004 00015180 
mar/02 00:12:16 ipsec,debug,packet 80010005 8003fde9 80020001 80040002 03000024 5b010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010005 8003fde9 80020001 80040001 03000028 5c010000 800b0001 
mar/02 00:12:16 ipsec,debug,packet 000c0004 00015180 80010003 800e0080 8003fde9 80020001 80040015 03000028 
mar/02 00:12:16 ipsec,debug,packet 5d010000 800b0001 000c0004 00015180 80010003 800e0080 8003fde9 80020001 
mar/02 00:12:16 ipsec,debug,packet 80040014 03000028 5e010000 800b0001 000c0004 00015180 80010003 800e0080 
mar/02 00:12:16 ipsec,debug,packet 8003fde9 80020001 80040013 03000028 5f010000 800b0001 000c0004 00015180 
mar/02 00:12:16 ipsec,debug,packet 80010003 800e0080 8003fde9 80020001 80040004 03000028 60010000 800b0001 
mar/02 00:12:16 ipsec,debug,packet 000c0004 00015180 80010003 800e0080 8003fde9 80020001 80040003 03000028 
mar/02 00:12:16 ipsec,debug,packet 61010000 800b0001 000c0004 00015180 80010003 800e0080 8003fde9 80020001 
mar/02 00:12:16 ipsec,debug,packet 80040012 03000028 62010000 800b0001 000c0004 00015180 80010003 800e0080 
mar/02 00:12:16 ipsec,debug,packet 8003fde9 80020001 80040011 03000028 63010000 800b0001 000c0004 00015180 
mar/02 00:12:16 ipsec,debug,packet 80010003 800e0080 8003fde9 80020001 80040010 03000028 64010000 800b0001 
mar/02 00:12:16 ipsec,debug,packet 000c0004 00015180 80010003 800e0080 8003fde9 80020001 8004000f 03000028 
mar/02 00:12:16 ipsec,debug,packet 65010000 800b0001 000c0004 00015180 80010003 800e0080 8003fde9 80020001 
mar/02 00:12:16 ipsec,debug,packet 8004000e 03000028 66010000 800b0001 000c0004 00015180 80010003 800e0080 
mar/02 00:12:16 ipsec,debug,packet 8003fde9 80020001 80040005 03000028 67010000 800b0001 000c0004 00015180 
mar/02 00:12:16 ipsec,debug,packet 80010003 800e0080 8003fde9 80020001 80040002 03000028 68010000 800b0001 
mar/02 00:12:16 ipsec,debug,packet 000c0004 00015180 80010003 800e0080 8003fde9 80020001 80040001 03000024 
mar/02 00:12:16 ipsec,debug,packet 69010000 800b0001 000c0004 00015180 80010001 8003fde9 80020001 80040015 
mar/02 00:12:16 ipsec,debug,packet 03000024 6a010000 800b0001 000c0004 00015180 80010001 8003fde9 80020001 
mar/02 00:12:16 ipsec,debug,packet 80040014 03000024 6b010000 800b0001 000c0004 00015180 80010001 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040013 03000024 6c010000 800b0001 000c0004 00015180 80010001 
mar/02 00:12:16 ipsec,debug,packet 8003fde9 80020001 80040004 03000024 6d010000 800b0001 000c0004 00015180 
mar/02 00:12:16 ipsec,debug,packet 80010001 8003fde9 80020001 80040003 03000024 6e010000 800b0001 000c0004 
mar/02 00:12:16 ipsec,debug,packet 00015180 80010001 8003fde9 80020001 80040012 03000024 6f010000 800b0001 
mar/02 00:12:16 ipsec,debug,packet 000c0004 00015180 80010001 8003fde9 80020001 80040011 03000024 70010000 
mar/02 00:12:16 ipsec,debug,packet 800b0001 000c0004 00015180 80010001 8003fde9 80020001 80040010 03000024 
mar/02 00:12:16 ipsec,debug,packet 71010000 800b0001 000c0004 00015180 80010001 8003fde9 80020001 8004000f 
mar/02 00:12:16 ipsec,debug,packet 03000024 72010000 800b0001 000c0004 00015180 80010001 8003fde9 80020001 
mar/02 00:12:16 ipsec,debug,packet 8004000e 03000024 73010000 800b0001 000c0004 00015180 80010001 8003fde9 
mar/02 00:12:16 ipsec,debug,packet 80020001 80040005 03000024 74010000 800b0001 000c0004 00015180 80010001 
mar/02 00:12:16 ipsec,debug,packet 8003fde9 80020001 80040002 00000024 75010000 800b0001 000c0004 00015180 
mar/02 00:12:16 ipsec,debug,packet 80010001 8003fde9 80020001 80040001 0d00000c 09002689 dfd6b712 0d000014 
mar/02 00:12:16 ipsec,debug,packet 12f5f28c 457168a9 702d9fe2 74cc0100 00000014 afcad713 68a1f1c9 6b8696fc 
mar/02 00:12:16 ipsec,debug,packet 77570100 
mar/02 00:12:16 ipsec sent phase1 packet MikrotikIP.241[500]<=>ciscoIP.10[500] 8d8ce4832f371fcb:0000000000000000 
mar/02 00:12:16 ipsec,debug ===== received 52 bytes from ciscoIP.10[500] to MikrotikIP.241[500] 
mar/02 00:12:16 ipsec,debug,packet 8d8ce483 2f371fcb 41016a35 072a2912 0b100500 00000000 00000034 00000018 
mar/02 00:12:16 ipsec,debug,packet 00000001 0100000e 0d0011f4 00000001 00000001 
mar/02 00:12:16 ipsec,debug receive Information. 
mar/02 00:12:16 ipsec,debug begin. 
mar/02 00:12:16 ipsec,debug seen nptype=11(notify) len=24 
mar/02 00:12:16 ipsec,debug succeed. 
mar/02 00:12:16 ipsec,debug ciscoIP.10 notify: NO-PROPOSAL-CHOSEN 
mar/02 00:12:16 ipsec ciscoIP.10 fatal NO-PROPOSAL-CHOSEN notify messsage, delete phase1 handle. 
mar/02 00:12:21 ipsec,debug Removing PH1... 
mar/02 00:12:21 ipsec,info ISAKMP-SA deleted MikrotikIP.241[500]-ciscoIP.10[500] spi:8d8ce4832f371fcb:0000000000000000 rekey:1 
mar/02 00:12:21 ipsec,debug an undead schedule has been deleted.
Top
 
davorin
Member Candidate
Member Candidate
Posts: 115
Joined: Sun Mar 03, 2019 6:23 pm

Re: IPSec Xauth PSK client-to-site?

Sun Mar 03, 2019 7:10 pm

That would be nice to know if this would work....

At least it is not possible on opnsense/pfsense/junos....and would love to be able to share a company ipsec connection in my home LAN.
Top
 
td32
Member Candidate
Member Candidate
Topic Author
Posts: 112
Joined: Fri Nov 18, 2016 5:55 am

Re: IPSec Xauth PSK client-to-site?

Tue Mar 05, 2019 7:54 pm

Post full IPsec debug logs. If I recall correctly, you have to use my-id=key-id when connecting to cisco XAuth server.
thanks this was the missing info
Code: Select all
my-id=key-id
my-id=groupID
Top
 
peter777
just joined
Posts: 2
Joined: Sun Mar 16, 2014 10:01 pm

Re: IPSec Xauth PSK client-to-site?

Sun Mar 29, 2020 4:31 pm

Hello.
Help me, please.
Can mikrotik work as a cisco vpn client (IPSec Xauth PSK)? How can this be done?
Top
 
juniormarangao
just joined
Posts: 1
Joined: Tue Apr 21, 2020 2:18 am

Re: IPSec Xauth PSK client-to-site?

Tue Apr 21, 2020 2:32 am

Post full IPsec debug logs. If I recall correctly, you have to use my-id=key-id when connecting to cisco XAuth server.
I have a similar issue, I can connect but after 1 minute, sometimes 1 minute and 20 seconds, the connection fall down and reconnect again, but never establishes more that time.

Someone knows how can I fix it?


Thanks
Top
 
diegokkk
just joined
Posts: 4
Joined: Tue Jun 22, 2021 12:47 pm

Re: IPSec Xauth PSK client-to-site?

Sat Dec 17, 2022 11:20 pm

Code: Select all
# mar/02/2019 00:22:06 by RouterOS 6.42.12
/ip ipsec policy group
set [ find default=yes ] name=groupID
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha512,sha256,sha1,md5 \
    enc-algorithms=aes-256-cbc,aes-256-ctr,aes-256-gcm,3des pfs-group=none
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc,aes-192-cbc name=\
    proposal-H
/ip ipsec peer
add address=ciscoIP.10/32 auth-method=pre-shared-key-xauth \
    compatibility-options=skip-peer-id-validation dh-group="ecp256,ecp384,ecp5\
    21,ec2n185,ec2n155,modp8192,modp6144,modp4096,modp3072,modp2048,modp1536,m\
    odp1024,modp768" disabled=yes enc-algorithm="aes-256,camellia-256,aes-192,\
    camellia-192,aes-128,camellia-128,3des,blowfish,des" exchange-mode=\
    main-l2tp hash-algorithm=md5 my-id=key-id nat-traversal=no \
    proposal-check=claim secret=Pass2 send-initial-contact=no \
    xauth-login=user1 xauth-password=pass1
Hello,

I have same problem. Trying to connect to Cisco VPN but can not.

Did you succeed?

Can you post your configuration because if I enter /ip ipsec peer I can not configure all your attributes because of new ROS version?
Top
Post Reply

Who is online

Users browsing this forum: No registered users and 32 guests
  4. RouterOS
  5. General