CloudLabBox
Try the free demo

MikroTik MTCRE lab 5 of 14

PPP VPNs: L2TP over IPsec and SSTP between sites

Join a branch to head office with the PPP-based VPNs of the MTCRE outline: L2TP protected by IPsec as the main tunnel and SSTP over TLS with your own certificate authority as the backup, with routes pushed from the PPP secrets and automatic fall-back.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 2,816 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCRE RouterOS v7 guided labs, then 05 - PPP VPNs - L2TP over IPsec and SSTP between sites

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
5 vCPU, 2,816 MB
Smallest plan
Lite

The scenario

A firm of surveyors runs a branch office whose firewall policy only allows "standard" VPNs: L2TP with IPsec, or TLS-based SSTP on port 443, which passes almost any hotel or office firewall. Fernvale will build both between HQ and the Branch router: L2TP/IPsec as the main tunnel, SSTP as the backup, each carrying the routes between the two LANs.

ItemValue
HQ WAN / Branch WAN203.0.113.2/30 / 198.51.100.2/30
L2TP accountbranch-l2tp / Branch-l2tp1, tunnel 172.16.20.1 (HQ) ↔ 172.16.20.2 (Branch), IPsec pre-shared key L2tp-psk1
SSTP accountbranch-sstp / Branch-sstp1, tunnel 172.16.30.1 ↔ 172.16.30.2
LANsHQ 192.168.1.0/24 · Branch 192.168.2.0/24

What you’ll practise

  • Compare VPN types: IPIP, EoIP, GRE, PPTP, SSTP, L2TP, PPPoE and WireGuard
  • Run an L2TP server with IPsec required and a matching client
  • Create a certificate authority and a server certificate on RouterOS, and run an SSTP server
  • Use PPP secrets with fixed tunnel addresses and routes that are added when a client connects
  • Use two tunnels with different route distances for fail-over
  • Read PPP sessions, IPsec peers and tunnel status

The tasks

  1. Choose the tunnel type
  2. Prepare the PPP accounts on HQ
  3. L2TP with IPsec
  4. Build your own certificate authority for SSTP
  5. SSTP as the backup tunnel
  6. Test the fall-back

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of PPP VPNs - L2TP over IPsec and SSTP between sites5 nodes, 4 links. Every link is listed as text below the diagram.ISPHQBranchPC-HQPC-BRether2eth0ether2eth0ether1ether1ether2ether1
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP ether1 to HQ ether1
  • ISP ether2 to Branch ether1
  • HQ ether2 to PC-HQ eth0
  • Branch ether2 to PC-BR eth0
Nodes in PPP VPNs: L2TP over IPsec and SSTP between sites, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
HQMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
BranchMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
PC-HQVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC-BRVPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCRE RouterOS v7 guided labs.

  3. Open 05 - PPP VPNs - L2TP over IPsec and SSTP between sites and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCRE labs

All MikroTik MTCRE labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.