Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
0
votes
0answers
4 views

IPSec tunnel data usage / overhead when idle

We are currently evaluating a setup with endnodes connected over IPSec to our VPN (configured using strongswan). Given the endnodes get their internet connection through an expensive cellular network, ...
0
votes
2answers
46 views

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

This question is about encryption in data communications, defined broadly to include: Line scrambling at layer 1 MACsec at layer 2 IPsec at layer 3 TLS at layer 4 etc. All of these encryption ...
0
votes
1answer
43 views

Access IPSec site from another IPSec site

Our company delivers, installs and maintains custom build hardware at customer sites. In all cases the delivered setup contains at least 1 server and 2 network devices. To keep the control over the ...
0
votes
2answers
37 views

Setup IPSEC in Hub/Spoke fashion

I'm trying to setup IPSEC tunnels in a hub/spoke type fashion. I've emulated this in GNS3 by creating three sites. Each site uses an IOSv router as it's WAN router. I'm using site 2 as the hub and ...
2
votes
1answer
101 views

Confusion about Route based IPSEC site-site vpn and policy based IPSEC site-site VPN

I am confused about the major difference between a policy-based VPN and routed-based site-site Vpn
1
vote
1answer
48 views

Juniper QFX Site to Site VPN

Im trying to setup a site to site vpn between two Juniper QFX5110's. Each end of the link is on the same subnet (so directly connected switches over dark fibre). I have configured each physical ...
0
votes
2answers
34 views

IPSEC between two offices with SAME local networks. How should I do nat? [duplicate]

I have two spokes with same local networks and want to do IPSEC between them. When I try to ping 172.17.214.111 from 192.168.5.0 (from right side to left side) I see packet on Cisco router and I see ...
1
vote
3answers
96 views

But confused about SSL VPN and IPsec Site -Site VPN

What might be difference between sslvpn and site-site vpn . Which one among two is secure and it's significance
0
votes
0answers
26 views

network cutover for remote site from L2 to L3 over IPSec tunnel

I have been trying to cutover one of our remote sites (A) to the new ISP we have purchased. The existing setup is utilizing L2 through another remote site (B) and coming back to the main campus. The ...
0
votes
3answers
56 views

Site-to-site IPSec tunnel over Load balancer

I'm having a following topology Could this be archived? I've configured this network, but routing between the two VLAN-s are not working. Using Ubiquity Edge X routers. Could this be archived with ...
0
votes
0answers
24 views

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6?

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6 ?
0
votes
1answer
93 views

Is it possible to setup IPsec behind NAT without port forwarding?

We want to setup a IPsec connection between customer sites and our office so we can manage the hardware we place at customer sites (e.g. barriers). Its important that the VPN connection stays up all ...
1
vote
2answers
60 views

IPSec Tunnel Mode

Assuming an organisation has 2 offices at two different locations and needs secure communication between them. As far as I understand IPSec, we can use tunnel mode to provide end to end encryption for ...
0
votes
3answers
48 views

Do i need VLAN per customer when i want to give users (secure) access to specific customer sites

This question is a follow up on this question. We are currently working on the network design, nothing is implemented yet. Our network will exist out of our own (internal) network and lot of customer ...
2
votes
2answers
528 views

IKEv2 tunnel between ASA and Mikrotik

Trying to move from pfSense to Mikrotik for an office router, and the only stumbling block is maintaining a site-to-site IPSEC tunnel between it and our Cisco ASA. The settings all look correct to me, ...
0
votes
1answer
62 views

Create IPSEC VPN between three Routers?

I'm attempt to build essentially an IPSEC tunnel mesh between three Cisco IOSv routers. I've been able to build an IPSEC tunnel between two directly connected routers but once I add the third router ...
0
votes
0answers
67 views

Hub and spoke IPSec in pfsense

I have 9 different sites and one HQ site where all 9 remote sites connect to via IPSec VPN. All are pfsense firewalls. I want to allow traffic between site 2, 3 and 4. But I do not want to configure ...
0
votes
1answer
176 views

Cisco ASA IPSec Site-to-Site VPN Rx Bytes not increasing

I have IPsec Site-to-Site VPN from my ASA to customer. After customer complain about VPN down, I reset the tunnel now I can see Login time duration 12h:34m Byte TX is 543240 and Byte Rx is 0. What ...
0
votes
0answers
19 views

ipsec site to site vpn phase1 and phase2 negotiation

in ipsec site to site vpn, how initiator and responder negotiates in phase1 and phase2 and what is security association in phase1 and phase2 ? How ike correlate with oakley, Isakmp and Skeme ?
2
votes
0answers
35 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
0
votes
0answers
10 views

Ipsec connection and nat only one site [duplicate]

There are two companies and two of them connected to each other with İPsec vpn. Company A has a server and company B want to reach to company A server. Which company need to configure nat on its ...
0
votes
1answer
1k views

IPSEC Phase 1 error

Was does the MM_NO_STATE usually mean when having errors bringing phase 1 up? IPv4 Crypto ISAKMP SA dst src state conn-id status X.X.X.122 X.X.X.107 MM_NO_STATE ...
0
votes
0answers
60 views

QoS over IPSec Site-to-Site VPN: Concerns and Questions

(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
1
vote
1answer
39 views

IPSec does not work via backup interface

Cisco ASA 5506-X connected to two ISP - main and standby channel, interfaces outside_1 and outside_2. IPSec works via outside_1, but does not work via outside_2, if outside_1 down. At this moment ...
2
votes
1answer
54 views

Cisco 5505 ASA firewall Ipsec vpn- Can connect two outside different public ip to two different local subnets

I only get one IPSEC vpn connection up but not the other. Link to access configs on Google: https://drive.google.com/open?id=1yB_yIWvJ51A0UeNbkAEiTH9YMIEipqy_ profile1- outside interface - 66.x.x.x ...
0
votes
1answer
30 views

Site-to-Site IPSEC through load balancer with persistence

what I'm trying to achieve is a site to site IPSEC tunnel going through a load balancer, (both sites have pfsense and balancer is f5 big ip) the reason why i'm trying to do that is because: - Site A ...
0
votes
1answer
19 views

IP-Sec VPN Tunnel Established Between 2 Remote Machines. Why Can't Machines In Their Subnets Connect Across? [closed]

Have 2 Remote Ubuntu Machines in different subnets. one: 192.168.1.0/24 Two: 192.168.2.0/24 Established VPN tunnel between 2 machines, 1 in each subnet. Their IPs: Public IPs 1.1.1.1 2.2.2.2 ...
0
votes
2answers
476 views

Cisco ASA IKE Receiver: Runt ISAKMP packet discarded on Port 500

I have lots of ikev1 tunnel running on our production Cisco ASA5585 and today i have configured ikev2 tunnel for one of our new customer and i have started seeing following error, and not sure what is ...
0
votes
0answers
45 views

IKE Main Mode - Dynamic peers

So i searched for some time now, read the https://tools.ietf.org/html/rfc2409RFC and simply couldn't find an answer to why Main Mode needs static adresses. The RFC states Aggressive Mode does not ...
2
votes
2answers
68 views

SRX to ASA IPSec troubles

we built a VPN between partner's Cisco ASA (unknown version) and my Juniper SRX 340. The tunnel seems to go up properly: root@fw01> show security ike security-associations node0: ----------------...
1
vote
1answer
220 views

Cisco dVTI - Virtual-Access interface has no IP address

i'm struggeling with some dVTI Issue on a Cisco ASR1000 box. here is my configuration for the hub site: crypto keyring FOO-KEYRING pre-shared-key hostname r2-foo key iawg8b32hah ! crypto isakmp ...
1
vote
0answers
43 views

Chckpoint Remote Access VPN Multiple ISP external interface [closed]

I'm in a situation where I have to suggest the best solution when client has two ISP connected to a checkpoint firewall cluster. AFAIK, we cannot activate or make use of two external interfaces for ...
0
votes
3answers
168 views

IPSec VPN timers query

I have a couple of queries related to the IPSec VPN and I believe someone would clarify my doubts. Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating? Why ...
4
votes
0answers
775 views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
0
votes
1answer
79 views

IPsec VPN route in Checkpoint

I have created a ipsec VPN from site A (Cisco) to Site B (checkpoint R77.20). At site B, i have a static 1-1 NAT applied: ipx --ipy Tunnel is live and connection up; I can telnet my site B system ...
1
vote
0answers
51 views

IPsec tunnel with multiple networks NATed [closed]

I'm trying to set up an IPsec connection between two sites: our Azure network and our client's local network. To be flexible and avoid any current or potential future IP range overlappings I wand to "...
0
votes
1answer
396 views

How do you define interesting traffic using an IPSec Profile on a Cisco router?

I apologize if this is a duplicate, but I'm having difficulty figuring out how to define interesting traffic on a Cisco router using an IPSec Profile referenced by a tunnel interface. The old-school ...
1
vote
1answer
691 views

Traceroute through IPSec tunnel

askk Hi. When I do traceroute from host 192.168.11.0/24 to the server 10.0.0.0/24, which is site B. When the packets get into the public area it show Request timed out (as shown in this figure). I'm ...
-1
votes
1answer
71 views

GRE over IPSec Transport vs. Tunnel Mode

I have a misunderstanding, in this article, Figure 4-9, in Transport Mode, first header (IPsec Hdr), is correct? Should not be GRE IP Hdr? https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/...
-1
votes
1answer
139 views

Site-to-site IPsec and rerouting to another IPsec tunnel

We have three different geo sites (SITE1, SITE2 and SITE3) and each site has PFSense firewall installed. Sites have been connected together with IPSec tunnels. Also Site2 is connected to customer ...
4
votes
2answers
119 views

Is Cisco IPsec different from ordinary IPsec?

Is Cisco IPsec different from ordinary IPsec? Although Windows 10 has built-in VPN support for L2TP/IPSec, it does not support IPSec provided by Cisco. Thus, we generally need to install hand-made ...
2
votes
0answers
461 views

GRE over IPsec problem

I'm trying to build a GRE Tunnel with IPSec encryption between two routers, but I keep getting error message saying "%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet..." Immediately I ...
1
vote
1answer
59 views

VoIP, IPsec configuration

I have a topology in GNS3 with an IPsec VPN tunnel between C1 and C2 (https://imgur.com/dnNkssU). In clients networks i am configured a CME and a Softphone. When i make a call the quality is very bad. ...
0
votes
1answer
442 views

Can both IPsec endpoint be configured as the initiator?

Then configuring an IPsec tunnel, I can usually set if the device should act as the initiator or the responder (or even both). However, what would happen if both endpoint are configured as the ...
2
votes
1answer
228 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
3
votes
1answer
319 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
1
vote
1answer
1k views

Keep Cisco site-to-site tunnel up permanently

I have Cisco ASA site-to-site tunnel with remote and which i don't have control. I have following config: crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 ...
1
vote
1answer
433 views

IPSec route-based vpn st0 interface

As i know, the st0 interface is used when the gateways are configured with route based VPN. But my question is, say below is the topology A<---->B<---->C<---->D A and D are hosts, B and C ...
0
votes
1answer
42 views

What is the reason for encrypting Identity field under IPsec phase1?

Why Identity fields are encrypted in IPsec phase 1 around packet 5/6 ? provided that the Identity field contains IP of either end. Does it has any significance ? Does it holds anything different then ...
0
votes
0answers
80 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...

1
2 3 4 5 6