Questions tagged [ike]
Questions relating to Internet Key Exchange (all versions) configuration, troubleshooting and operating.
33
questions
0
votes
2
answers
102
views
IPsec PFS Confusion
I'm reading conflicting things about how PFS works in IPsec. Some sources say it's simply a renegotiation of the Phase 1 IKE/ISAKMP SA that ignores the original IKE/ISAKMP SA lifetime value and that ...
- 1
0
votes
1
answer
478
views
Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes
My end of the tunnel is on an ASAv in AWS. (version 9.14)
show crypto isakmp sa
4 IKE Peer: 212.239.x.y
Type : L2L Role : responder
Rekey : no State : ...
- 213
1
vote
0
answers
188
views
Diffie-Hellman with PSK/PKI in the context of IKEv1
It seems I fail to understand few things about DH's functionality in the context of IKEv1.
A little bit of context first:
During IKE Main Phase, with the 3rd and 4th messages, the peers each exchange ...
3
votes
1
answer
217
views
Wireshark Decrypting IKEv1 Text PSK to Hex
I'm trying to debug a Cisco VPN setup as part of a Uni Lab (so please don't worry about posting of keys etc. it's just a toy setup with no internet facing connection).
I want to decrypt the IKEv1 ...
- 171
1
vote
0
answers
852
views
IKEv2 between Cisco router and Google cloud VPN
Hey I'm trying to create a tunnel between cisco router and google cloud vpn (client site) but the connection is stuck on stage 2 (UP-IDLE), need help where the problem may lie.
Some debug that I get ...
- 11
4
votes
2
answers
1k
views
MTU/MSS Oddness?
We have an IKEv2 IPSec tunnel between two Sophos XG Firewall appliances in a corporate system for a remote site.
We don't have any specialized MSS or MTU settings other than what the IPSec tunnel ...
- 181
1
vote
1
answer
84
views
IKEv2 notification payload regarding IKE SA
I am puzzled about two paragraphs regarding a notification payload in section 3.10 of RFC7296. There you can find the following:
o Protocol ID (1 octet) - If this notification concerns an existing
...
- 161
0
votes
0
answers
98
views
How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6?
How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6 ?
0
votes
1
answer
792
views
Problem with getting IKEv1 tunnel between Cisco and Palo Alto to establish a tunnel more quickly
I have a Cisco 2901 router that has an IKEv1 IPSec VPN with a Palo Alto firewall. We had a problem with our existing VPN setup where it takes a long time to get the tunnel to come back up when re-...
0
votes
1
answer
800
views
IKEV2 between ASA and Router problem
I am trying to configure a ikev2 vpn between asa and router using tunnel interface.
I have encountered the problem of it not even establishing the connection. There is no problem in the connectivity ...
- 37
0
votes
1
answer
8k
views
IPSEC Phase 1 error
Was does the MM_NO_STATE usually mean when having errors bringing phase 1 up?
IPv4 Crypto ISAKMP SA
dst src state conn-id status
X.X.X.122 X.X.X.107 MM_NO_STATE ...
3
votes
1
answer
208
views
Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates?
On a Juniper Firewall, the command show security pki local-certificate will give all sorts of detail for a local certificate. (The sort of certificate you would use to stand up an IKE connection)
My ...
- 165
1
vote
0
answers
205
views
IKE Main Mode - Dynamic peers
So i searched for some time now, read the https://www.rfc-editor.org/rfc/rfc2409[RFC][1] and simply couldn't find an answer to why Main Mode needs static adresses.
The RFC states Aggressive Mode does ...
- 11
1
vote
0
answers
866
views
Unable to Initiate a VPN tunnel using IKEv2 [closed]
I'm having an issue with a VPN tuunel between my Firewall (ASA 5516-X) and a third party firewall so I can't check the config in the second firewall. So I decide to debug my firewall and I realized ...
0
votes
1
answer
2k
views
Can both IPsec endpoint be configured as the initiator?
Then configuring an IPsec tunnel, I can usually set if the device should act as the initiator or the responder (or even both). However, what would happen if both endpoint are configured as the ...
- 871
-2
votes
1
answer
1k
views
IPSec SA being Unidirectional
From what I’ve read, IKE SAs are Birectional and IPSec SAs are unidirectional.
But if the same proposals are to be agreed by both the ends, say protocol esp, Authentication algorithm as hmac-sha1-...
- 395
3
votes
1
answer
673
views
Azure VPN vs. Cisco ASA
I have a Cisco 5516-x with v9.7(1)21 on my end and I am trying to create a working VPN to Azure. It looks to me like phase1 goes well but phase2 fails due to policy mismatch.
Any suggestions for how ...
- 143
4
votes
2
answers
2k
views
IKE phase 1 and phase 2
Was going through the IKE phase 1 and phase 2. I have some questions regarding the same which is bothering me with respect to main mode and quick mode.Please correct me if i go wrong somewhere.
Phase ...
- 395
2
votes
0
answers
2k
views
RSA key not working with trustpoint used for IPSec
I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup.
Importing is ...
- 61
1
vote
1
answer
1k
views
Cisco 5506-x dynamic site to site tunnel doesn't works
I am followed ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example
step by step, currently I am using IP address 10.0.0.1 for the static peer and 10.0.0.2 for the dynamic peer, but seems ...
- 13
2
votes
1
answer
7k
views
IPSec IKEv2 connection failure due to RSA authentication issue
I'm trying to get an IPSec/IKEv2 setup working, which was implement following this
I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
- 61
2
votes
1
answer
3k
views
IPsec IKEv2 with StrongSwan Cert+EAP not working
I'm trying to setup a Cisco router (881H) to act as a head end for an IPsec IKEv2 VPN. The target setup is meant to be used by StrongSWan clients (currently testing on Android smartphone), and we wish ...
- 61
5
votes
0
answers
1k
views
Is IKEv2 remote access VPN possible to an ASA 5510 without Cisco AnyConnect as the client?
I'm trying to configure a remote acccess vpn into a cisco ASA 5510 (9.1(7)15). I want to be able to use IKEv2 with Certificate + user/password xauth with strongswan as the client under Ubuntu.
I ...
- 213
5
votes
1
answer
3k
views
Advertise static route via BGP from Cisco ASA 5512-x
I'm currently using a Cisco ASA 5512-X to establish an IKEv1 VPN with an Amazon Web Services VPC. I'm using BGP to advertise the route as per this example. So far everything is working great, my local ...
- 153
2
votes
1
answer
1k
views
Why is IKE needed for IPSec VPN?
I am confused about the need of IKE Phase 1. As far as I understand, IKE uses 2 phases, first one is to exchange parameters, such as encryption, authentication method, hashing type and so on. It ...
- 386
2
votes
3
answers
9k
views
IKEv2 Site to Site from Cisco ASA 5506 to Azure "RouteBased" VPN
I am having a little bit of a problem setting up a IKEv2 site to site to Azure cloud. I am using the IPSec permaeters from this document.
Phase1 is established, but I cant figure out Phase2, here is ...
- 156
1
vote
2
answers
2k
views
Multiple IPSEC tunnels between 2 Cisco Routers
I have a scenario where we need to establish multiple IPSEC tunnels between 2 devices.
In the above scenario, ASR has multiple VRFs and we want to create IPSEC tunnel for each VRF and the other end ...
- 11
5
votes
2
answers
3k
views
Why does IKE use UDP instead of TCP?
Why does IKE use UDP, and handle any retransmission itself?
(Larger IKE packets may cause UDP fragmentation and are dropped by some ISPs: IKE over TCP.
- 153
5
votes
0
answers
577
views
Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached
I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message:
%ASA-4-713239: IP_Address: Tunnel Rejected: ...
- 131
4
votes
1
answer
10k
views
ASA VPN works as responder but not as initiator
I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.)
When the pfSense starts the connection, everything works fine. When the ...
- 259
5
votes
1
answer
1k
views
Deploying an IPSEC secure-channel - isakmp SA empty
I am currently trying to encrypt traffic in an IPSEC tunnel with a simple lab architecture. The architecture looks like this :
I am trying to mount an IPSEC tunnel between Router A & Router B, ...
- 787
7
votes
1
answer
17k
views
Juniper SRX: Where do I look to see IKE debug messages?
Going through a JSEC book I noticed the following slide explains that there are 6 ike phase 1 messages that take place for a tunnel to establish.
I am looking in the kmd log and traceoptions data but ...
- 828
81
votes
4
answers
82k
views
What's the difference between IKE and ISAKMP?
I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly)....
- 4,718