Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

0
votes
1answer
41 views

L2TP IPSec Remote VPN - Many users connecting remotely from same access

Can someone explain to me, why isn't possible to connect 2 or more clients to a VPN server when the users are behind the same public IP (NAT/PAT). What I mean is: if there is already a user connected ...
0
votes
1answer
16 views

Result of running `restart ipsec-key-management`

I have Juniper SRX 1400 which is used mainly for IPSEC tunnels. And now I facing a bug in firmware with ID PR1085657 (IKE doesn't come up when the SRX is the initiator). Possible solutions to this is ...
1
vote
1answer
45 views

Site-to-site IPSEC for multiple peers with dynamic IP on Juniper SRX

Looking for possible solution. I have Juniper SRX 1400 (12.1X47-D20.7) with static WAN IP in data-center and multiple sites with dynamic WAN IP addresses. I need to build with them site-to-site VPN's....
2
votes
0answers
68 views

RSA key not working with trustpoint used for IPSec

I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup. Importing is ...
1
vote
1answer
63 views

Latency-sensitive channel bonding

One of our satellite offices is connected by a Satellite connection with no other high bandwidth option. Reliability is good and bandwidth is acceptable (50/10 MB/s), but latency is making, ssh, VPN ...
2
votes
2answers
94 views

GRE-IPsec Tunnel between Cisco Router and a Linux Router

I am trying to create a GRE/IPsec tunnel between Cisco router and a Linux Router. The tunnel is UP and active, but when I do a "show crypto session" on the Cisco router the Active SA's keep on ...
4
votes
1answer
126 views

IPSec failure with `IKE message failed its sanity check or is malformed`

I've been battling with my IPSec configuration for some days (with foolish deadline looming) and would like to ask for help with it failing its initial connection. It's designed as client-to-router ...
2
votes
0answers
23 views

encryption gateway vs domain and source ip issues

(This is the same setup as a previous question.) My VPN connection was no longer working (for ~4h), so I called the remote end's tech support. While we were talking, the link mysteriously started ...
0
votes
1answer
47 views

Configuring IPsec VPN and TTL

I have two sites, each using their own firewall. Once a Cisco Meraki, another a Cisco ASA. The two sites use IPsec to establish a VPN tunnel. The Question: If each of the two sites have different ...
0
votes
2answers
40 views

IPSec - NAT-T inner/outer IP of the gateway?

I was configuring an IPSec VPN and somehow I can't figure out what the inner/outer IP of my gateway would be. Have a look at this image : Imagine I have my site-to-site VPN, with my gateway having ...
0
votes
0answers
15 views

IPsec VPN Setup

Below is the flow 10.1.0.0>Data Center Firewall>Internet Router> ----Internet---- So basically i am setting up new ipsec tunnel between two Cisco internet routers for branch office users to access ...
-1
votes
3answers
45 views

Connecting to subnets with IPSec VPN, how to route?

I set up a site-to-site VPN between two TP-Link routers, following the instructions here: https://www.tp-link.com/ae/faq-380.html . The VPN is based on IPSec. Now both routers say that the IPSec ...
0
votes
1answer
39 views

Cisco VRF aware dynamic VTI based IPSEC VPN

im struggeling on a Cisco IPSEC Konfiguration. My aim is to terminate spoke sites behind CGN gateways into a MPLS L3VPN Network via IPSEC tunnels. The router at hub site is a ASR1k running IOS XE 3....
0
votes
1answer
50 views

ASA VPN Tunnel NAT Issues

I've been trying to jump through two tunnel. A Customer has a cloud solution which we need access to. Since we already have a vpn site2site tunnel to the customer we can already access his LAN. What ...
0
votes
0answers
21 views

IPsec with public IP for Remote Gateway and Remote Subnet (address)

I have a customer with a public IP for the Remote Gateway in Phase 1 (8.x.y.a) and a public IP address as Remote Subnet in Phase 2 (8.x.y.b). Customer setup uses a Cisco ASR. On my site I use pfSense ...
4
votes
1answer
61 views

Confused on perfect forward secrecy, someone kindly help me

i just read following article In IPsec VPN, how is the pre-shared key encrypted? got knowledge about phase 1 also basic line over PFS: for every new negotiation of Phase 2 SA the 2 gateways must ...
1
vote
1answer
41 views

IPv6 VPNs source address selection

Say I have the following IPv6 prefix assigned to me by my ISP : 2a01:1000:1000::/48 with 2a01:1000:1000::1/48 assigned to my VPN server. I set up a VPN with a /64 from that block to assign to my ...
1
vote
1answer
369 views

SonicWall is dropping encrypted packets with error “sonicwall ipsec vpn decryption failed selector check error”

I have implemented a Site-to-Site IPsec tunnel between a Juniper SSG firewall and a SonicWall. However, any traffic that I send over the tunnel gets dropped on the SonicWall with an error saying ...
3
votes
3answers
93 views

Layer 3 tunnel with Dynamic IP address

I want to ask whether it is possible to configure Layer 3 Tunnel with the two end points/interfaces have dynamic IP address? If the interface IP change, the tunnel will have to be re-negotiated, is ...
1
vote
2answers
572 views

Cisco ASA MTU vs TCP MSS

I am trying to set jumbo MTU for Cisco ASA 5585 and I did following: asa1/pri/act(config)# mtu inside 9000 INFO: Jumbo frames should be enabled to receive packets more than 1500 MTU Use '...
3
votes
1answer
76 views

ASA as a local DNS resolver

I have an site to site VPN access configured by ASAs. My remote site needs to connect to the domain through the tunnel which will required DNS located on the main site. I would like to use DNS server ...
3
votes
1answer
769 views

IPsec Tunnel is showing decrypt packets counter but 0 encryption packets: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

I have just configured the IPSEC tunnel between my router and the Access point.I could see that the Tunnel has came up and Active in both sides. However,When I checked the "Show cyrpto ipsec sa" ,I ...
0
votes
1answer
142 views

PBR not working as expected

EDITED: ADDED FULL ROUTER CONFIG I have a cisco 2921. It uses EIGRP to learn its routing table and has no static default routes set up. I would like to keep it that way. The default route (learned ...
1
vote
1answer
310 views

Cisco ASA DH group and Lifetime of Phase 2

Not very good with ASAs so please have that in mind. I need to replace an ASA but can't seem to get some info on Phase 1 and Phase 2. I can get everything from Phase 1 except the DH group (got PFS ...
1
vote
2answers
182 views

SIte-to-Site VPN between ASAv8 and ASAv9: NAT issue

I'm setting up a site-to-site via ASDM. Initially I configured both devices correctly, matching policies, crypto, etc and set both inside networks as "NAT exempt". Problem is, when I apply changes on ...
1
vote
1answer
120 views

Cisco 5506-x dynamic site to site tunnel doesn't works

I am followed ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example step by step, currently I am using IP address 10.0.0.1 for the static peer and 10.0.0.2 for the dynamic peer, but seems ...
1
vote
2answers
60 views

Cisco IPSEC Tunnel with hidden local networks

I've got an ipsec tunnel that's up and working with ATT. They require that the phase 2 IP's not be local LAN's, but public IP's. So, my phase 1 is X.X.X.132, and my Phase 2 is on the same subnet as X....
0
votes
1answer
138 views

SonicWall Site-to-site VPN with WAN IP endpoint

I'm not a real network engineer (just something I must dabble in from time to time), so hopefully I will provide enough detail and use the right terminology here. We have a site-to-site VPN ...
4
votes
1answer
425 views

IPSec site-to-site with/without NAT

I am connecting my office to a client's network via IPSec. The need is for me to connect directly to internal IPs on their network; there is no need for them to connect to any services on my internal ...
2
votes
1answer
343 views

How to keep an ASA tunnel up for lifetime?

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening: When I send a packet or generate interesting traffic, it brings up the tunnel and everything ...
0
votes
1answer
569 views

IPSec IKEv2 connection failure due to RSA authentication issue

I'm trying to get an IPSec/IKEv2 setup working, which was implement following this I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
1
vote
1answer
70 views

Secure communication between multiple sites over Internet

Does anyone know what would be the best practice to securely connect 2 or more branches with HQ over the Internet, and to allow communication between all of them (so anyone can contact anyone) if I ...
0
votes
0answers
319 views

IPsec tunnel getting drop and reconnect itself frequently

We have IPsec tunnel which is working but somehow getting drop and reconnect itself and that causing disturbance in application, i am unable to find root cause. I have check isakmp and crypto map ...
1
vote
2answers
1k views

How are VPN Clients given IP addresses when they connect to VPN Routers such as VyOS? (How do Virtual IP Address Pools fit in?)

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network when they connect to the StrongSWAN or OpenVPN VPN Server that's embedded in VyOS ...
2
votes
1answer
610 views

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

We have following scenario, my side we have Cisco ASA and we have IPsec tunnel to Customer US-Datacenter and i can ping 172.16.0.0 subnet from my ASA (local LAN 10.0.0.0/8) but now i want to ping EU-...
1
vote
1answer
329 views

IPsec vpn missing crypto keyring

We have VPN tunnel with our customer and they sent their side VPN config and i am trying to put that config in my Cisco ASA 5585 (9.x) version and it has missing crypto keyring command Customer ...
2
votes
1answer
334 views

How to configure site to site VPN between Cisco ASA and Cisco router? [closed]

I have CISCO ASA on one site and CISCO ROUTER on other side, both have outside interface facing public IP and doing NAT for internal VLAN's. How to connect different VLAN's on one site to VLAN's on ...
0
votes
0answers
688 views

IPsec VPN between Cisco ASA 5505 8.2(5) and MikroTik 6.40.5

I'm trying to set up IPsec VPN between Cisco ASA 5505 8.2(5) and MikroTik 6.40.5. The whole configuration looks good for me, but it isn't working properly. I can ping MikroTik's inside IP address (10....
0
votes
1answer
168 views

VPN Hardware Client with Split Tunneling (How do I design this?)

I want to implement a network design for my home office that has the capabilities of connecting to a VPN or Tunneling service and performs Split Tunneling within the network appliances. The reason ...
2
votes
2answers
2k views

Cisco ASA: Unable to establish IPSec tunnel with IKEv2: Auth exchange failed

This is a Cisco ASA 5515-X with software 9.6(3)20. The remote side didn't tell me what they use, must be Strongswan or something. Using the following debug commands debug crypto ipsec 255 debug ...
1
vote
1answer
3k views

ASA IPsec Removing peer from correlator table failed, no match

We have two ASA 5585 and ASA 5506 and we're trying to setup an IPsec VPN tunnel between both ASA but getting this error [SITE-1]--------Internet------------[SITE-2] I'm getting this error in debug ...
0
votes
0answers
138 views

Problem with VPN - cisco - can't ping own interface

We are student from an IT school and we need to finish our project tomorrow. The project is a big network using OSPF, and we have a (kind of fake) VPN between two different places. We have to "...
2
votes
1answer
204 views

ISR <> ISR (IPSec VPN)

Trying to form IPsec between two ISR-4000s. There is Nexus in between to form eigrp in between. There is eigrp even spinning inside ISR's inside interface. (leaving it on for lab purposes for now). [...
0
votes
1answer
321 views

Cisco IPSec Pass-through on ASA 5505 not working

I have been busting my brain for a few days not and I have so far not been able to figure out what the issue here is. The Problem: I am unable to establish a Client-to-ASA IPSec tunnel from behind ...
0
votes
1answer
209 views

ISAKMP problem on F5 BIG-IP

I'm trying to move a site-to-site IPsec tunnel from a Cisco ASA 5505 and a BIG-IP LTM+AFM version 12.1.0. The tunnel was up and traffic flowed properly when the tunnel was terminated on ASA but not ...
0
votes
0answers
376 views

Does changing MTU on a site to site vpn will affect other services?

We have two offices and i configured a site to site ipsec vpn. Most of the time the latency is high. looking on the internet, some suggests to change the MTU value on 1392. the largest packet that i ...
0
votes
0answers
2k views

pfSense 2.3 as L2TP / IPSec VPN client

I'm running my own L2TP / IPSec VPN server in anothet country. Now i have multiple clients in my network. I stead of connecting every single device to the VPN, i search a way to let my pfSense connect ...
3
votes
2answers
122 views

Why does IPSec in transport mode not guarantee integrity?

Wikipedia says: Unlike Authentication Header (AH), ESP in transport mode does not provide integrity and authentication for the entire IP packet. I don't understand why this would be true. What is ...
1
vote
0answers
795 views

IPsec IKEv2 with StrongSwan Cert+EAP not working

I'm trying to setup a Cisco router (881H) to act as a head end for an IPsec IKEv2 VPN. The target setup is meant to be used by StrongSWan clients (currently testing on Android smartphone), and we wish ...
2
votes
1answer
835 views

Cisco ASA single isakmp policy for multiple crypto map

We are going to setup multiple site-to-site tunnels to our remote office and every tunnel configuration is identical (same hash,encryption etc). The question is: Do I need to create a separate ...