OSPF over L2TP/IPsec tunnel

[g_alexey]

Hello I need connect my routers to Fortigate 60D and propagate OSPF routes. Routers dehind NAT and dynamic public IP. Is this possible?

I'm trying to set up OSPF over L2TP/IPsec, but my configuration not working.

# show vpn l2tp 
config vpn l2tp
set eip 172.17.16.62
set sip 172.17.16.1
set status enable
set usrgrp "L2TP_IPsec"
end

# show vpn ipsec phase1-interface
config vpn ipsec phase1-interface
edit "IPsec"
set type dynamic
set interface "infanet"
set peertype any
set proposal aes256-md5 3des-sha1 aes192-sha1
set comments "VPN: IPsec (Created by VPN wizard)"
set dhgrp 2
set psksecret ENC ***
next
end

# show vpn ipsec phase2-interface
config vpn ipsec phase2-interface
edit "IPsec"
set phase1name "IPsec"
set proposal aes256-md5 3des-sha1 aes192-sha1
set dhgrp 2
set encapsulation transport-mode
set l2tp enable
set comments "VPN: IPsec (Created by VPN wizard)"
set keylifeseconds 3600
next
end

OSPF config:

# show router ospf 
config router ospf
    set router-id 1.1.1.200
    config area
        edit 0.0.0.0
        next
    end
    config ospf-interface
        edit "IPsec"
            set interface "IPsec"
            set ip 172.17.16.1
            set dead-interval 40
            set hello-interval 10
            set network-type point-to-point
        next
    end
    config network
        edit 1
            set prefix 192.168.23.20 255.255.255.252
        next
        edit 2
            set prefix 172.17.174.0 255.255.255.192
        next
        edit 3
            set prefix 10.21.221.0 255.255.255.0
        next
        edit 4
            set prefix 172.17.16.0 255.255.255.192
        next
    end
    config redistribute "connected"
    end
    config redistribute "static"
    end
    config redistribute "rip"
    end
    config redistribute "bgp"
    end
    config redistribute "isis"
    end
end

After connection created one Point-To-Point OSPF interface:

# get router info ospf interface
ppp1 is up, line protocol is up
Internet Address 172.17.16.1/32, Area 0.0.0.0, MTU 1300
Process ID 0, Router ID 1.1.1.200, Network Type POINTOPOINT, Cost: 100
Transmit Delay is 1 sec, State Point-To-Point
Timer intervals configured, Hello 10.000, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:08
Neighbor Count is 1, Adjacent neighbor count is 1
Crypt Sequence Number is 874292
Hello received 74 sent 74, DD received 6 sent 5
LS-Req received 3 sent 1, LS-Upd received 2 sent 12
LS-Ack received 10 sent 2, Discarded 0

OSPF on client 172.17.16.2 work fine, but on client 172.17.16.3 not work:

# diag debug flow filter add 172.17.16.2

# diag debug flow trace start 100
id=20085 trace_id=1791 func=print_pkt_detail line=5251 msg="vd-root received a packet(proto=89, 172.17.16.2:0->224.0.0.5:0) from ppp1. "
id=20085 trace_id=1791 func=init_ip_session_common line=5407 msg="allocate a new session-0156de39"
id=20085 trace_id=1792 func=print_pkt_detail line=5251 msg="vd-root received a packet(proto=89, 172.17.16.2:0->224.0.0.5:0) from ppp1. "
id=20085 trace_id=1792 func=resolve_ip_tuple_fast line=5326 msg="Find an existing session, id-0156de39, original direction"

# diag debug flow filter add 172.17.16.3
# diag debug flow trace start 100
id=20085 trace_id=2021 func=print_pkt_detail line=5251 msg="vd-root received a packet(proto=89, 172.17.16.3:0->224.0.0.5:0) from ppp2. "
id=20085 trace_id=2021 func=init_ip_session_common line=5407 msg="allocate a new session-0158c8a3"
id=20085 trace_id=2021 func=ip_session_handle_no_dst line=5480 msg="trace"

[andrefernandes]

Hi,

I know this is an old thread but I did a research on this.

Using OSPF won't work because you can't configure multiple P2P OSPF-Interfaces manually, so the OSPF neighborship will be flapping between two clients.

For dynamic routing i'm using BGP and works fine. In your setup is missing the policy that permit traffic L2TP from IPSEC interface to your "public" IP, only after this my tunnel goes up. 

My setup is a FortiGate VM as L2TP Server and a Mikrotik as L2TP client.

Follow this guide: https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/386346/l2tp-over-ipsec to setup L2TP over IPSEC first, then, use BGP to get routes.