PPTP and L2TP · Topic 3 of 3

L2TP Client and Server Configuration

Configure an L2TP server and client on RouterOS, with and without IPsec: enable the server, set the secret, add the client interface and verify the link.

5 min
Includes a diagram

In a nutshell

The server is enabled with /interface l2tp-server server set enabled=yes.
The client is /interface l2tp-client add.
use-ipsec=yes adds IPsec, and ipsec-secret is the shared key.

What it is

An L2TP setup has a server that accepts tunnels and a client that dials in, usually protected by IPsec.

The steps match PPTP: a secret, a profile, an enabled server and a client interface. The extra part is the IPsec option, which adds encryption that L2TP does not have on its own.

RouterOS can create the IPsec settings for you when you turn on use-ipsec.

How it works

You prepare the server, create the client with matching IPsec settings, and then route traffic into the tunnel.

Server side

/ppp profile add name=l2tp-prof local-address=10.98.0.1 remote-address=10.98.0.2
/ppp secret add name=branch2 password=Str0ng service=l2tp profile=l2tp-prof
/interface l2tp-server server set enabled=yes default-profile=l2tp-prof use-ipsec=yes ipsec-secret=SharedKey1

The use-ipsec setting turns on IPsec support on the server. The ipsec-secret is the pre shared key. Its value must be the same on the client.

Allow UDP ports 1701, 500 and 4500, and ESP, in the input chain.

Client side

/interface l2tp-client add name=l2tp-out1 connect-to=203.0.113.1 user=branch2 password=Str0ng use-ipsec=yes ipsec-secret=SharedKey1 disabled=no

Setting	What it does
`connect-to`	Address of the L2TP server.
`user` and `password`	Credentials that match a secret on the server.
`use-ipsec`	Builds an IPsec tunnel under the L2TP session.
`ipsec-secret`	Pre shared key for that IPsec tunnel.
`add-default-route`	Installs a default route through the tunnel.
`profile`	PPP profile for the client side.
`allow`	Authentication methods the client may use.

Plain L2TP and L2TP with IPsec

Mode	Settings	Result
Plain L2TP	`use-ipsec=no`	Tunnel without encryption
L2TP with IPsec	`use-ipsec=yes` and a matching secret	Encrypted tunnel

If the server insists on IPsec and the client does not use it, the tunnel does not come up. A wrong ipsec-secret also stops it at the IPsec stage, before PPP login even starts.

How a failure shows up

A decision flow for an L2TP tunnel that will not come up: if the PPP log shows a login attempt, check the secret, password and service; if it shows none, check IPsec settings, key and ports. An IPsec failure and a PPP failure look different. If the PPP log shows no login attempt at all, look at IPsec first. If a login is rejected, look at the secret, the password and the service value.

Server binding and routing

As with PPTP, you can create a static server interface for one user.

/interface l2tp-server add name=l2tp-branch2 user=branch2
/ip route add dst-address=192.168.60.0/24 gateway=l2tp-branch2

The route sends the branch LAN into the tunnel. The client needs a route in the other direction. The routes setting in the secret can also install the server side route while the user is connected.

Address assignment

The profile gives the two tunnel addresses. Using an IP pool for the client address lets many clients dial in with one profile. A fixed address in the secret keeps a branch router on the same address.

Verification

/interface l2tp-client print
/ppp active print
/ip ipsec installed-sa print

A running client shows the flag R. /ppp active print shows the session on the server. /ip ipsec installed-sa print shows the security associations when IPsec is in use.

Version note

L2TP with use-ipsec works in RouterOS v6 and v7. The IPsec objects that RouterOS creates behind the scenes differ in detail between the two versions, so inspect them rather than assume.

What to remember for the exam

Seven facts cover most L2TP configuration questions.

The server is enabled with /interface l2tp-server server set enabled=yes.
The client is /interface l2tp-client add.
use-ipsec=yes adds IPsec, and ipsec-secret is the shared key.
The key must match on both ends, and the client must use IPsec when the server insists on it.
The user and password must match a /ppp secret with service=l2tp or any.
L2TP with IPsec needs UDP 1701, UDP 500, UDP 4500 and ESP.
A route into the tunnel is needed to reach a remote LAN.

Exam tip

When the tunnel fails with no PPP log entry, suspect IPsec, usually a key mismatch or a blocked port.

Common mistakes

These four errors appear again and again.

Different IPsec settings on the two ends. A client with no IPsec against a server that insists on it, or a different key, never connects.

Opening only UDP 1701. IPsec also needs UDP 500, UDP 4500 and ESP.

Wrong service in the secret. A secret set to pptp does not serve an L2TP client.

No route to the remote LAN. The tunnel is up, yet LAN hosts cannot be reached.

Watch out

A pre shared key typed carelessly is the most common cause of a silent L2TP and IPsec failure. Retype it on both ends.

Check yourself

Work through these three questions.

Which setting turns on IPsec protection for an L2TP tunnel?
use-ipsec=yes on the server and the client, with the same ipsec-secret on both.
Which ports must be open for L2TP with IPsec?
UDP 1701, UDP 500 and UDP 4500, plus ESP.
What does it suggest when an L2TP tunnel fails and the log shows no PPP login attempt?
The failure is probably at the IPsec stage, for example a key mismatch or a blocked port.

Topic 3 of 3 in PPTP and L2TP

Test yourself on PPTP and L2TP

The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.