CloudLabBox
Try the free demo

MikroTik MTCSE lab 8 of 10

Secure remote access: SSTP with certificates and L2TP/IPsec

Give Fernvale's field engineers remote access to head office: SSTP over TCP 443 where both the server and the client prove themselves with certificates from Fernvale's CA, and L2TP/IPsec with a pre-shared key for clients that only speak the built-in VPN, with plain L2TP refused.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 1,024 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCSE RouterOS v7 guided labs, then 08 - Secure remote access - SSTP with certificates and L2TP-IPsec

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
4 vCPU, 1,024 MB
Smallest plan
Lite

The scenario

Fernvale's field engineers work from hotels, homes and customer sites, and need to reach the head-office LAN (10.1.0.0/24). Two kinds of client must be supported:

  • Alice uses SSTP. It runs over TCP 443, like HTTPS, so it passes almost any hotel or guest firewall. Fernvale's policy is that both ends authenticate with certificates from Fernvale's own CA.
  • Bob's device only has the classic built-in L2TP/IPsec client, so he connects with a pre-shared key.

Here ALICE and BOB are RouterOS routers standing in for the engineers' devices; they sit on the "Internet" behind the ISP.

DeviceAddressRole
HQether1 198.51.100.2/30, lan 10.1.0.1/24VPN server and CA
ISP198.51.100.1/30, 203.0.113.1/24the Internet
ALICE203.0.113.10/24SSTP client
BOB203.0.113.20/24L2TP/IPsec client

What you’ll practise

  • Explain why SSTP passes almost any firewall and how certificates protect it from impersonation
  • Run an SSTP server that verifies client certificates, and a client that verifies the server's certificate and address
  • Run L2TP over IPsec with a pre-shared key and read the IPsec SAs it builds
  • Use PPP profiles, pools and secrets for remote-access users
  • Drop L2TP that didn't arrive through IPsec

The tasks

  1. Certificates for the server and for Alice
  2. PPP profile, pool and users
  3. SSTP with certificates on both ends
  4. L2TP over IPsec with a pre-shared key
  5. Refuse L2TP that isn't inside IPsec

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Secure remote access - SSTP with certificates and L2TP-IPsec4 nodes and 1 network, 4 links. Every link is listed as text below the diagram.HQISPALICEBOBInternetether2ether1ether1ether1ether1
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ ether1 to ISP ether1
  • ISP ether2 to Internet (network)
  • ALICE ether1 to Internet (network)
  • BOB ether1 to Internet (network)
Nodes in Secure remote access: SSTP with certificates and L2TP/IPsec, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
ALICEMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
BOBMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCSE RouterOS v7 guided labs.

  3. Open 08 - Secure remote access - SSTP with certificates and L2TP-IPsec and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCSE labs

All MikroTik MTCSE labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.