Creating the IPSec/L2TP VPN
Let's create an IPSec/L2TP VPN directly through the system. The VPN can be used for communication between Cpehub and the provider's OLTs, or between the ACS and the provider's CPEs.
In IPSec/L2TP, the server runs on the ISP side. If you already have the username, password, and PSK defined on your router, have them on hand. If you haven't configured the router yet, you can create the VPN here first and then configure Mikrotik using the same credentials.
Step by step
-
Go to the Administration → VPNs menu.
-
Click the + Add VPN button.
-
Under Type, select IPSec/L2TP. The form will show the fields specific to this type.
General settings
| Field | What to enter |
|---|---|
| Name | VPN identification name. Letters, numbers, underscore (_), and hyphen (-) only. |
| Server | Where the VPN will be used: Cpehub (system communication with the OLTs) or ACS (TR-069 communication with the CPEs). |
| VPN Active | Leave it on so Cpehub tries to connect as soon as the VPN is created. |
| Remote IP (ISP Equipment) | Public IP of your L2TP router/server at the ISP. |
| Remote Port (ISP Equipment) | L2TP port on the ISP side. Default: 1701/UDP. |
| Remote Networks (ISP internal networks) | ISP internal networks that will be reached through the VPN (e.g., where the OLTs are). One block per line. |
| Connectivity Test Remote IP | An internal ISP IP that responds to ICMP (ping) and is reachable through the VPN. Used by the system to test whether the VPN is operational. |
IPSec/L2TP settings
| Field | What to enter |
|---|---|
| VPN Username | L2TP username configured on the ISP side (e.g., cpehub-olts). |
| VPN Password | That username's password. |
| IPSec PSK (Pre-Shared Key) | The IPSec pre-shared key (ipsec-secret on the router). Must be identical on both sides. |
| Debug Mode | Leave it off in production. Turn it on only temporarily to debug connection issues. |
- Click Register.
The VPN will be created on the selected server. If the ISP side is already configured, the status should change to Connected within moments.
In the VPNs listing, each IPSec/L2TP VPN shows the local data (Cpehub side — IP, PPP interface, L2TP port, routes) and the remote data (ISP side — IP, port, username, password, and PSK, with a Show button). Use this data to double-check the router's configuration.
Next step
Now configure the L2TP server on the ISP's equipment: