Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ike]

Questions relating to Internet Key Exchange (all versions) configuration, troubleshooting and operating.

-2
votes
1answer
48 views

IPSec SA being Unidirectional

From what I’ve read, IKE SAs are Birectional and IPSec SAs are unidirectional. But if the same proposals are to be agreed by both the ends, say protocol esp, Authentication algorithm as hmac-sha1-...
3
votes
1answer
134 views

Azure VPN vs. Cisco ASA

I have a Cisco 5516-x with v9.7(1)21 on my end and I am trying to create a working VPN to Azure. It looks to me like phase1 goes well but phase2 fails due to policy mismatch. Any suggestions for how ...
3
votes
2answers
327 views

IKE phase 1 and phase 2

Was going through the IKE phase 1 and phase 2. I have some questions regarding the same which is bothering me with respect to main mode and quick mode.Please correct me if i go wrong somewhere. Phase ...
2
votes
0answers
291 views

RSA key not working with trustpoint used for IPSec

I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup. Importing is ...
1
vote
1answer
440 views

Cisco 5506-x dynamic site to site tunnel doesn't works

I am followed ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example step by step, currently I am using IP address 10.0.0.1 for the static peer and 10.0.0.2 for the dynamic peer, but seems ...
1
vote
1answer
2k views

IPSec IKEv2 connection failure due to RSA authentication issue

I'm trying to get an IPSec/IKEv2 setup working, which was implement following this I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
2
votes
0answers
1k views

IPsec IKEv2 with StrongSwan Cert+EAP not working

I'm trying to setup a Cisco router (881H) to act as a head end for an IPsec IKEv2 VPN. The target setup is meant to be used by StrongSWan clients (currently testing on Android smartphone), and we wish ...
2
votes
0answers
676 views

Is IKEv2 remote access VPN possible to an ASA 5510 without Cisco AnyConnect as the client?

I'm trying to configure a remote acccess vpn into a cisco ASA 5510 (9.1(7)15). I want to be able to use IKEv2 with Certificate + user/password xauth with strongswan as the client under Ubuntu. I ...
6
votes
1answer
1k views

Advertise static route via BGP from Cisco ASA 5512-x

I'm currently using a Cisco ASA 5512-X to establish an IKEv1 VPN with an Amazon Web Services VPC. I'm using BGP to advertise the route as per this example. So far everything is working great, my local ...
2
votes
1answer
563 views

Why is IKE needed for IPSec VPN?

I am confused about the need of IKE Phase 1. As far as I understand, IKE uses 2 phases, first one is to exchange parameters, such as encryption, authentication method, hashing type and so on. It ...
2
votes
3answers
6k views

IKEv2 Site to Site from Cisco ASA 5506 to Azure “RouteBased” VPN

I am having a little bit of a problem setting up a IKEv2 site to site to Azure cloud. I am using the IPSec permaeters from this document. Phase1 is established, but I cant figure out Phase2, here is ...
1
vote
2answers
747 views

Multiple IPSEC tunnels between 2 Cisco Routers

I have a scenario where we need to establish multiple IPSEC tunnels between 2 devices. In the above scenario, ASR has multiple VRFs and we want to create IPSEC tunnel for each VRF and the other end ...
6
votes
2answers
2k views

Why does IKE use UDP instead of TCP?

Why does IKE use UDP, and handle any retransmission itself? (Larger IKE packets may cause UDP fragmentation and are dropped by some ISPs: IKE over TCP.
2
votes
0answers
379 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
3
votes
1answer
6k views

ASA VPN works as responder but not as initiator

I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.) When the pfSense starts the connection, everything works fine. When the ...
5
votes
1answer
928 views

Deploying an IPSEC secure-channel - isakmp SA empty

I am currently trying to encrypt traffic in an IPSEC tunnel with a simple lab architecture. The architecture looks like this : I am trying to mount an IPSEC tunnel between Router A & Router B, ...
7
votes
1answer
14k views

Juniper SRX: Where do I look to see IKE debug messages?

Going through a JSEC book I noticed the following slide explains that there are 6 ike phase 1 messages that take place for a tunnel to establish. I am looking in the kmd log and traceoptions data but ...
71
votes
3answers
56k views

What's the difference between IKE and ISAKMP?

I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly)....