Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
0 votes
1 answer
66 views

Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

My end of the tunnel is on an ASAv in AWS. (version 9.14) show crypto isakmp sa 4 IKE Peer: 212.239.x.y Type : L2L Role : responder Rekey : no State : ...
1 vote
2 answers
431 views

Is it possible to implement IPSEC over MPLS?

On a high level, I understand that the data-traffic(original ip packet) is encrypted and encapsulated in ESP header (imagine a IPSEC in tunnel mode). Generally, this IPSEC tunnel is triggered by ...
  • 1,095
0 votes
0 answers
41 views

IP pkt len in ESP transport mode? How to validate ESP pad length?

What will be the value of packet-length/Total length field in the IP headers for ESP packets in transport mode? For instance, in tunnel mode below are the values:- Outer-IP header's Packet length = ...
  • 1,095
0 votes
2 answers
45 views

IPSEC ESP tunnel mode - Are the ip addresses in outer IP HDR same as addresses in inner encrypted IP HDR?

Am trying to understand how IPSEC in tunnel mode achieves the VPN functionality. I understand that the IP header and payload along with TCP/UDP headers are encrypted. But, if the src and dst addresses ...
  • 1,095
2 votes
2 answers
54 views

Why does IKEv2 forbid dynamic address updates for hosts behind NAT?

In RFC7296, Section 2.23 it is written: There are cases where a NAT box decides to remove mappings that are still alive (for example, the keepalive interval is too long, or the NAT box is rebooted). ....
  • 121
0 votes
1 answer
50 views

Switching Internet connection on Cisco ASA

I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
  • 155
2 votes
2 answers
434 views

FortiGate: IPSec peer-to-peer and two remote peers

I have a FortiGate firewall in the main office and some branches with Cisco ASA. An IPsec tunnel runs between the main office and each branch. Some branches have two ISP - main and reserve. For ...
  • 155
1 vote
0 answers
102 views

Diffie-Hellman with PSK/PKI in the context of IKEv1

It seems I fail to understand few things about DH's functionality in the context of IKEv1. A little bit of context first: During IKE Main Phase, with the 3rd and 4th messages, the peers each exchange ...
1 vote
1 answer
58 views

OSPFv3 Authentication IPSEC SPI/Logging issues - Can you filter out logs?

I'm running into a problem with our Cisco ASR-1002HX and ASR-1006X. I have a mix of Juniper and Cisco routers all configured exclusively with IPv6. All of our routers are in the same ospfv3 area 0. We ...
  • 157
1 vote
1 answer
921 views

IPSec IKEv2 on pfSense: "parsed INFORMATIONAL request 2 [ N(AUTH_FAILED) ]"

I am trying to setup an IPSec IKEv2 VPN Network on a pfSense. The pfsense is situated directly behind the modem. I connect to it by a static IP address. There is no double NAT. I followed this ...
1 vote
2 answers
659 views

Why does IPsec not support Multicast/Broadcast?

Many sources site GRE as supporting broadcast/multicast and IPsec does not. Both GRE and IPsec are merely tunneling protocols. Therefore there is nothing inherent about tunneling protocols which ...
  • 127
2 votes
2 answers
372 views

Site-to-Site VPN with Sophos XG using tunnel interface

So I have configured a Sophos XG site-to-site vpn according to this document: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/...
3 votes
4 answers
1k views

What's the advantage of IPSec over TLS/DTLS? [closed]

What's the benefit of IPSec over TLS and DTLS ? If someone's goal is to assure authentication, integrity and confidentiality, can't he/she simply encrypt the content with the two last protocols (on ...
0 votes
1 answer
95 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
0 votes
1 answer
86 views

VPN/IPsec router support in Packet Tracer

I would like to know, if a router doesn't support VPN (meaning it can't be used as a VPN server) can it still route an IPsec packet? And which router I should use as a server for IPSec (AH tunnel mode)...
1 vote
0 answers
552 views

IKEv2 between Cisco router and Google cloud VPN

Hey I'm trying to create a tunnel between cisco router and google cloud vpn (client site) but the connection is stuck on stage 2 (UP-IDLE), need help where the problem may lie. Some debug that I get ...
1 vote
0 answers
269 views

UNIFI USG GATEWAY IPSEC OVER L2TP VPN [closed]

At my office I have a Unifi USG Gateway that currently has 3 IPSEC VPN Tunnels (Lan-To-Lan VPN) configured. I also have a L2TP Remote VPN Network configured so that when I'm outside of my office I can ...
1 vote
0 answers
1k views

Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]

I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL. Can ...
1 vote
0 answers
3k views

Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]

I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel. [PA]-----------(internet)-----------[Cisco ASA] If i ping from Cisco ASA side lan to PA ...
  • 4,247
0 votes
0 answers
52 views

static IP multicast routing with IPSEC

for a specific application, I need to route a multicast flow with IPSEC (we use a CISCO ASA 5508 firewall), I am not a network expert then I will try to explain as best as I can our issue I don't need ...
  • 1
0 votes
0 answers
50 views

Does multicast over tunnels (e.g., GRE) require IGMP/MLD?

When subscribing to a multicast group on a tunnel device such as a GRE tunnel, are you supposed to participate in IGMP/MLD over that tunnel in order to announce your membership in the multicast group? ...
  • 317
4 votes
2 answers
679 views

MTU/MSS Oddness?

We have an IKEv2 IPSec tunnel between two Sophos XG Firewall appliances in a corporate system for a remote site. We don't have any specialized MSS or MTU settings other than what the IPSec tunnel ...
0 votes
1 answer
135 views

Cisco IPsec VPN tunnel problem

I have a problem with VPN configuration. This is the topology I created: First updated licenses to make the VPN available: license boot module c1900 technology-package securityk9 IPsec Router ...
  • 3
0 votes
0 answers
89 views

Editing a crypto map with multiple entries

We're attempting to bring up an IPSEC tunnel with a Vendor. An engineer created the crypto map and wasnt able to establish a connection. I edited the entry to change the diffie-hillman group and the ...
  • 11
0 votes
2 answers
214 views

Why cant't IPSec's Transport Mode ESP be used in NAT64 although ESP doesn't sign the new IP header?

In RFC6146 stated: Any protocols that protect IP header are incompatible with NAT64. This implies that end-to-end IPsec verification will fail when the Authentication Header (AH) is used (both ...
1 vote
1 answer
43 views

IKEv2 notification payload regarding IKE SA

I am puzzled about two paragraphs regarding a notification payload in section 3.10 of RFC7296. There you can find the following: o Protocol ID (1 octet) - If this notification concerns an existing ...
2 votes
1 answer
419 views

Is an IPSec connection between 2 devices behind NAT possible?

We have tens of IPSec connections between our office and customer site's. We use an extra router in the customer network (so behind NAT) to initiate the connection to our office where a PFSense router ...
  • 199
0 votes
2 answers
144 views

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

This question is about encryption in data communications, defined broadly to include: Line scrambling at layer 1 MACsec at layer 2 IPsec at layer 3 TLS at layer 4 etc. All of these encryption ...
0 votes
1 answer
56 views

Access IPSec site from another IPSec site

Our company delivers, installs and maintains custom build hardware at customer sites. In all cases the delivered setup contains at least 1 server and 2 network devices. To keep the control over the ...
  • 199
0 votes
2 answers
57 views

Setup IPSEC in Hub/Spoke fashion

I'm trying to setup IPSEC tunnels in a hub/spoke type fashion. I've emulated this in GNS3 by creating three sites. Each site uses an IOSv router as it's WAN router. I'm using site 2 as the hub and ...
1 vote
1 answer
213 views

Confusion about Route based IPSEC site-site vpn and policy based IPSEC site-site VPN

I am confused about the major difference between a policy-based VPN and routed-based site-site Vpn
  • 11
1 vote
1 answer
261 views

Juniper QFX Site to Site VPN

Im trying to setup a site to site vpn between two Juniper QFX5110's. Each end of the link is on the same subnet (so directly connected switches over dark fibre). I have configured each physical ...
  • 25
0 votes
2 answers
62 views

IPSEC between two offices with SAME local networks. How should I do nat? [duplicate]

I have two spokes with same local networks and want to do IPSEC between them. When I try to ping 172.17.214.111 from 192.168.5.0 (from right side to left side) I see packet on Cisco router and I see ...
0 votes
3 answers
138 views

But confused about SSL VPN and IPsec Site -Site VPN

What might be difference between sslvpn and site-site vpn . Which one among two is secure and it's significance
's user avatar
0 votes
0 answers
37 views

network cutover for remote site from L2 to L3 over IPSec tunnel

I have been trying to cutover one of our remote sites (A) to the new ISP we have purchased. The existing setup is utilizing L2 through another remote site (B) and coming back to the main campus. The ...
  • 11
0 votes
3 answers
402 views

Site-to-site IPSec tunnel over Load balancer

I'm having a following topology Could this be achieved? I've configured this network, but routing between the two VLAN-s are not working. Using Ubiquity Edge X routers. Could this be archived with ...
  • 3
0 votes
0 answers
58 views

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6?

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6 ?
0 votes
1 answer
1k views

Is it possible to setup IPsec behind NAT without port forwarding?

We want to setup a IPsec connection between customer sites and our office so we can manage the hardware we place at customer sites (e.g. barriers). Its important that the VPN connection stays up all ...
  • 199
1 vote
2 answers
91 views

IPSec Tunnel Mode

Assuming an organisation has 2 offices at two different locations and needs secure communication between them. As far as I understand IPSec, we can use tunnel mode to provide end to end encryption for ...
  • 13
0 votes
3 answers
91 views

Do i need VLAN per customer when i want to give users (secure) access to specific customer sites

This question is a follow up on this question. We are currently working on the network design, nothing is implemented yet. Our network will exist out of our own (internal) network and lot of customer ...
  • 199
2 votes
2 answers
3k views

IKEv2 tunnel between ASA and Mikrotik

Trying to move from pfSense to Mikrotik for an office router, and the only stumbling block is maintaining a site-to-site IPSEC tunnel between it and our Cisco ASA. The settings all look correct to me, ...
  • 259
0 votes
1 answer
264 views

Create IPSEC VPN between three Routers?

I'm attempt to build essentially an IPSEC tunnel mesh between three Cisco IOSv routers. I've been able to build an IPSEC tunnel between two directly connected routers but once I add the third router ...
0 votes
1 answer
824 views

Cisco ASA IPSec Site-to-Site VPN Rx Bytes not increasing

I have IPsec Site-to-Site VPN from my ASA to customer. After customer complain about VPN down, I reset the tunnel now I can see Login time duration 12h:34m Byte TX is 543240 and Byte Rx is 0. What ...
  • 3
2 votes
0 answers
48 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
  • 393
0 votes
0 answers
10 views

Ipsec connection and nat only one site [duplicate]

There are two companies and two of them connected to each other with İPsec vpn. Company A has a server and company B want to reach to company A server. Which company need to configure nat on its ...
  • 1
0 votes
1 answer
6k views

IPSEC Phase 1 error

Was does the MM_NO_STATE usually mean when having errors bringing phase 1 up? IPv4 Crypto ISAKMP SA dst src state conn-id status X.X.X.122 X.X.X.107 MM_NO_STATE ...
0 votes
0 answers
369 views

QoS over IPSec Site-to-Site VPN: Concerns and Questions

(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
1 vote
1 answer
63 views

IPSec does not work via backup interface

Cisco ASA 5506-X connected to two ISP - main and standby channel, interfaces outside_1 and outside_2. IPSec works via outside_1, but does not work via outside_2, if outside_1 down. At this moment ...
  • 155
2 votes
1 answer
97 views

Cisco 5505 ASA firewall Ipsec vpn- Can connect two outside different public ip to two different local subnets

I only get one IPSEC vpn connection up but not the other. Link to access configs on Google: https://drive.google.com/open?id=1yB_yIWvJ51A0UeNbkAEiTH9YMIEipqy_ profile1- outside interface - 66.x.x.x ...
0 votes
1 answer
186 views

Site-to-Site IPSEC through load balancer with persistence

what I'm trying to achieve is a site to site IPSEC tunnel going through a load balancer, (both sites have pfsense and balancer is f5 big ip) the reason why i'm trying to do that is because: - Site A ...

1
2 3 4 5 6