Questions tagged [ike]

Questions relating to Internet Key Exchange (all versions) configuration, troubleshooting and operating.

Filter by
Sorted by
Tagged with
74
votes
3answers
63k views

What's the difference between IKE and ISAKMP?

I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly)....
7
votes
1answer
14k views

Juniper SRX: Where do I look to see IKE debug messages?

Going through a JSEC book I noticed the following slide explains that there are 6 ike phase 1 messages that take place for a tunnel to establish. I am looking in the kmd log and traceoptions data but ...
5
votes
2answers
3k views

Why does IKE use UDP instead of TCP?

Why does IKE use UDP, and handle any retransmission itself? (Larger IKE packets may cause UDP fragmentation and are dropped by some ISPs: IKE over TCP.
5
votes
1answer
2k views

Advertise static route via BGP from Cisco ASA 5512-x

I'm currently using a Cisco ASA 5512-X to establish an IKEv1 VPN with an Amazon Web Services VPC. I'm using BGP to advertise the route as per this example. So far everything is working great, my local ...
5
votes
1answer
1k views

Deploying an IPSEC secure-channel - isakmp SA empty

I am currently trying to encrypt traffic in an IPSEC tunnel with a simple lab architecture. The architecture looks like this : I am trying to mount an IPSEC tunnel between Router A & Router B, ...
4
votes
2answers
852 views

IKE phase 1 and phase 2

Was going through the IKE phase 1 and phase 2. I have some questions regarding the same which is bothering me with respect to main mode and quick mode.Please correct me if i go wrong somewhere. Phase ...
4
votes
1answer
7k views

ASA VPN works as responder but not as initiator

I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.) When the pfSense starts the connection, everything works fine. When the ...
3
votes
1answer
246 views

Azure VPN vs. Cisco ASA

I have a Cisco 5516-x with v9.7(1)21 on my end and I am trying to create a working VPN to Azure. It looks to me like phase1 goes well but phase2 fails due to policy mismatch. Any suggestions for how ...
3
votes
0answers
791 views

Is IKEv2 remote access VPN possible to an ASA 5510 without Cisco AnyConnect as the client?

I'm trying to configure a remote acccess vpn into a cisco ASA 5510 (9.1(7)15). I want to be able to use IKEv2 with Certificate + user/password xauth with strongswan as the client under Ubuntu. I ...
3
votes
0answers
418 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
2
votes
1answer
53 views

Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates?

On a Juniper Firewall, the command show security pki local-certificate will give all sorts of detail for a local certificate. (The sort of certificate you would use to stand up an IKE connection) My ...
2
votes
1answer
824 views

Why is IKE needed for IPSec VPN?

I am confused about the need of IKE Phase 1. As far as I understand, IKE uses 2 phases, first one is to exchange parameters, such as encryption, authentication method, hashing type and so on. It ...
2
votes
3answers
7k views

IKEv2 Site to Site from Cisco ASA 5506 to Azure “RouteBased” VPN

I am having a little bit of a problem setting up a IKEv2 site to site to Azure cloud. I am using the IPSec permaeters from this document. Phase1 is established, but I cant figure out Phase2, here is ...
2
votes
0answers
525 views

RSA key not working with trustpoint used for IPSec

I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup. Importing is ...
2
votes
1answer
3k views

IPSec IKEv2 connection failure due to RSA authentication issue

I'm trying to get an IPSec/IKEv2 setup working, which was implement following this I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
2
votes
0answers
2k views

IPsec IKEv2 with StrongSwan Cert+EAP not working

I'm trying to setup a Cisco router (881H) to act as a head end for an IPsec IKEv2 VPN. The target setup is meant to be used by StrongSWan clients (currently testing on Android smartphone), and we wish ...
1
vote
2answers
895 views

Multiple IPSEC tunnels between 2 Cisco Routers

I have a scenario where we need to establish multiple IPSEC tunnels between 2 devices. In the above scenario, ASR has multiple VRFs and we want to create IPSEC tunnel for each VRF and the other end ...
1
vote
1answer
630 views

Cisco 5506-x dynamic site to site tunnel doesn't works

I am followed ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example step by step, currently I am using IP address 10.0.0.1 for the static peer and 10.0.0.2 for the dynamic peer, but seems ...
1
vote
0answers
100 views

Unable to Initiate a VPN tunnel using IKEv2

I'm having an issue with a VPN tuunel between my Firewall (ASA 5516-X) and a third party firewall so I can't check the config in the second firewall. So I decide to debug my firewall and I realized ...
0
votes
1answer
64 views

Can both IPsec endpoint be configured as the initiator?

Then configuring an IPsec tunnel, I can usually set if the device should act as the initiator or the responder (or even both). However, what would happen if both endpoint are configured as the ...
0
votes
0answers
17 views

is crypto ikev2 supported on 1921 router?

is the "crypto ikev2" command supported on Cisco's 1921 ISR g2 router. I'm trying to deploy a site-to-site FlexVPN but the command wouldn't show. I updated the image to c1900-universalk9-mz.SPA.157-3....
0
votes
0answers
22 views

IKE Main Mode - Dynamic peers

So i searched for some time now, read the https://tools.ietf.org/html/rfc2409RFC and simply couldn't find an answer to why Main Mode needs static adresses. The RFC states Aggressive Mode does not ...
-2
votes
1answer
168 views

IPSec SA being Unidirectional

From what I’ve read, IKE SAs are Birectional and IPSec SAs are unidirectional. But if the same proposals are to be agreed by both the ends, say protocol esp, Authentication algorithm as hmac-sha1-...