Questions tagged [ipsec]
Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.
302
questions
0
votes
1
answer
56
views
Fortigate IPsec site-to-site routing issue
Site A needs IPsec with site B.
Site A networks 192.168.20.0/24 and 192.168.50.0/24 need to reach Site B network 192.168.1.0/24. And the other way around as well.
The problem is that Site A has a ...
- 3
0
votes
0
answers
13
views
Problems establishing IPsec Cisco IOS <--> Debian 12
I think I'm missing some config line
Cisco IOS is on GNS3, Debian is a remote VM in a company
Cisco config:
CISCO
crypto ikev2 proposal TEST
encryption aes-cbc-256
integrity sha256
group 14
crypto ...
- 1
0
votes
1
answer
33
views
What zone should I assign the tunnel interface to?
In the Palo Alto document.
https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-site-to-site-vpn/set-up-ipsec/set-up-an-ipsec-tunnel
Network Security
Set Up an IPSec ...
- 45
0
votes
1
answer
103
views
Remote access IPsec VPN tunnel connection between FortiGate firewall and native Windows VPN client fails to establish
Problem summary
I'm trying to setup a remote access IPsec IKEv2 VPN between a FortiGate firewall (FortiOS v7.2.8) and a native Windows VPN client with certificate based authentication.
I've went ...
0
votes
1
answer
63
views
Why is IPsec transport mode "vulnerable" for not having integrity of variable fields? Why is this so important?
With IPsec transport mode we CAN'T have integrity of variable fields (eg TTL and checksum). Why is it a problem? Is it? What could be the attack?
I think TTL expire or checksum modification (so both ...
- 1
0
votes
1
answer
95
views
Cisco ASA L2TP/IPsec split-tunnel not working for public Internet
I'm testing a setup using ASA to provide VPN over L2TP/IPSec PSK to support native IPSec clients such as iOS, Android, MacOS, Windows, etc.
The issue I'm running into is that when connected, the split-...
- 101
1
vote
1
answer
76
views
Pinging packets greater than 1500 between two proper configured machines on proper configured networks, always possible?
Given the following 3 subnet topology, I will give names to them to simplify it, I am using planets, I see it as a perfect geographic enumeration.
Sites
Office on Earth 172.1.x FiOS, default MTU
...
- 113
1
vote
1
answer
48
views
IPSec Site to Site VPN Connected but Subnets not Routing [closed]
Re: Creating a site to site vpn from ubuntu 22 + strongswan to cisco meraki
Issue: I've established a vpn tunnel but routing between clients on the network is not working.
meraki config:
Non-Meraki ...
- 111
0
votes
1
answer
68
views
How to access SVI from the other side of a tunnel? [closed]
With two vlans separated by an IPSec tunnel, I'm having issues reaching an SVI on the far end. Hosts on either end can ping each other without issue, but the SVI's do not respond from the far end, ...
- 3
1
vote
0
answers
68
views
Issue with Cisco ASA IPSec VPN clients can't access DMZ network
I have one ASA that is configured for IPSec VPN Cisco client. The VPN allow access to inside network, but trying to get it to my DMZ is a problem. My VPN address pool is defined as 124.140.1.x /24. My ...
- 11
0
votes
1
answer
140
views
IKEv2 Traffic Selector Narrowing Nuance
For IKEv2, when the responder receives traffic selector payloads from the initiator in the IKE_AUTH message, it must narrow the traffic selectors to be acceptable by policy.
I am curious about how the ...
1
vote
1
answer
169
views
Juniper MX with MS-MIC and ipsec performance
I've set up the gre over ipsec tunnel between SRX650 and MX5 (MS-MIC onboard). While SRX is able to serve ipsec tunnels traffic at about 100-200 Mbit/sec to other SRXes, I can get only about 1.5 Mbit/...
- 243
0
votes
1
answer
75
views
IPSec over L2GRE scenario
I wanted to know if this is a valid scenario and if it is possible to implement.
There is a remote site A. and a Data center site B. Both A and B have a edge router which runs an IPSec tunnel. An ...
- 113
0
votes
1
answer
257
views
How to configure IDr on Cisco ASA for AWS IPsec tunnels
I am currently facing an issue while attempting to establish IPsec tunnels between AWS and a Cisco ASA firewall. The AWS tunnel logs indicate that the Identity Resolution checks are failing, ...
0
votes
1
answer
330
views
DH groups support for isakmp policy
When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are ...
- 57
0
votes
2
answers
406
views
IPsec PFS Confusion
I'm reading conflicting things about how PFS works in IPsec. Some sources say it's simply a renegotiation of the Phase 1 IKE/ISAKMP SA that ignores the original IKE/ISAKMP SA lifetime value and that ...
- 1
1
vote
1
answer
123
views
VPN doesn't work
I'm trying to configure VPN between 2 routers:
R1: public IP is 200.0.0.6/30 on S0/0/1, private IP are 10.0.0.0/8 and 20.0.0.0/8
R3: public IP is 210.10.0.6/30 on S0/0/0, private IP is 192.168.3.0/24
...
- 27
0
votes
0
answers
107
views
Cisco IPSec VTI model not working as expected
I'm trying to new IPSec connection recommended by Cisco,
here
Now i reserved a DevNet CML Sandbox and using the IOS-XE routers in there, which is Dist-RT01 and Dist-RT02.
Since CML sandbox using mgmt ...
- 1
1
vote
0
answers
27
views
Complicated bridge between 2 servers [closed]
I have 3 servers:
comp_a, comp_b, comp_c
comp_a ([eth0 «10.15.14.55»]) 10.0.0.0/8 <———> comp_b ([eth0 «10.15.27.61», eth1 «10.15.26.61»] [eth1 «10.15.26.61» ]) <——VPN IPS (left = 10.15.0.0/16 ...
- 11
0
votes
2
answers
1k
views
How to solve high ping "spikes" to pfSense when ipSec connections are active?
Background information:
We have latency/freeze problems with our pfSense. To be able to answer the question i will first give some general background information:
We run pfSense V2.6.0 on following ...
- 221
0
votes
1
answer
826
views
Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes
My end of the tunnel is on an ASAv in AWS. (version 9.14)
show crypto isakmp sa
4 IKE Peer: 212.239.x.y
Type : L2L Role : responder
Rekey : no State : ...
- 223
1
vote
2
answers
3k
views
Is it possible to implement IPSEC over MPLS?
On a high level, I understand that the data-traffic(original ip packet) is encrypted and encapsulated in ESP header (imagine a IPSEC in tunnel mode). Generally, this IPSEC tunnel is triggered by ...
- 1,134
0
votes
0
answers
144
views
IP pkt len in ESP transport mode? How to validate ESP pad length?
What will be the value of packet-length/Total length field in the IP headers for ESP packets in transport mode?
For instance, in tunnel mode below are the values:-
Outer-IP header's Packet length = ...
- 1,134
0
votes
2
answers
736
views
IPSEC ESP tunnel mode - Are the ip addresses in outer IP HDR same as addresses in inner encrypted IP HDR?
Am trying to understand how IPSEC in tunnel mode achieves the VPN functionality. I understand that the IP header and payload along with TCP/UDP headers are encrypted. But, if the src and dst addresses ...
- 1,134
2
votes
2
answers
89
views
Why does IKEv2 forbid dynamic address updates for hosts behind NAT?
In RFC7296, Section 2.23 it is written:
There are cases where a NAT box decides to remove mappings that are
still alive (for example, the keepalive interval is too long, or the
NAT box is rebooted). ....
- 123
0
votes
1
answer
116
views
Switching Internet connection on Cisco ASA
I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
- 155
2
votes
2
answers
2k
views
FortiGate: IPSec peer-to-peer and two remote peers
I have a FortiGate firewall in the main office and some branches with Cisco ASA. An IPsec tunnel runs between the main office and each branch. Some branches have two ISP - main and reserve. For ...
- 155
1
vote
0
answers
248
views
Diffie-Hellman with PSK/PKI in the context of IKEv1
It seems I fail to understand few things about DH's functionality in the context of IKEv1.
A little bit of context first:
During IKE Main Phase, with the 3rd and 4th messages, the peers each exchange ...
1
vote
1
answer
92
views
OSPFv3 Authentication IPSEC SPI/Logging issues - Can you filter out logs?
I'm running into a problem with our Cisco ASR-1002HX and ASR-1006X. I have a mix of Juniper and Cisco routers all configured exclusively with IPv6. All of our routers are in the same ospfv3 area 0. We ...
- 157
1
vote
1
answer
3k
views
IPSec IKEv2 on pfSense: "parsed INFORMATIONAL request 2 [ N(AUTH_FAILED) ]"
I am trying to setup an IPSec IKEv2 VPN Network on a pfSense. The pfsense is situated directly behind the modem. I connect to it by a static IP address. There is no double NAT. I followed this ...
- 11
1
vote
2
answers
2k
views
Why does IPsec not support Multicast/Broadcast?
Many sources site GRE as supporting broadcast/multicast and IPsec does not. Both GRE and IPsec are merely tunneling protocols. Therefore there is nothing inherent about tunneling protocols which ...
- 127
2
votes
2
answers
889
views
Site-to-Site VPN with Sophos XG using tunnel interface
So I have configured a Sophos XG site-to-site vpn according to this document:
https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/...
6
votes
4
answers
4k
views
What's the advantage of IPSec over TLS/DTLS? [closed]
What's the benefit of IPSec over TLS and DTLS ? If someone's goal is to assure authentication, integrity and confidentiality, can't he/she simply encrypt the content with the two last protocols (on ...
- 161
0
votes
2
answers
188
views
Cisco ASA access-lists and net config
Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
0
votes
1
answer
203
views
VPN/IPsec router support in Packet Tracer
I would like to know, if a router doesn't support VPN (meaning it can't be used as a VPN server) can it still route an IPsec packet?
And which router I should use as a server for IPSec (AH tunnel mode)...
- 1
1
vote
0
answers
1k
views
IKEv2 between Cisco router and Google cloud VPN
Hey I'm trying to create a tunnel between cisco router and google cloud vpn (client site) but the connection is stuck on stage 2 (UP-IDLE), need help where the problem may lie.
Some debug that I get ...
- 11
1
vote
0
answers
332
views
UNIFI USG GATEWAY IPSEC OVER L2TP VPN [closed]
At my office I have a Unifi USG Gateway that currently has 3 IPSEC VPN Tunnels (Lan-To-Lan VPN) configured. I also have a L2TP Remote VPN Network configured so that when I'm outside of my office I can ...
- 111
1
vote
0
answers
2k
views
Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]
I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL.
Can ...
- 255
1
vote
0
answers
7k
views
Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]
I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel.
[PA]-----------(internet)-----------[Cisco ASA]
If i ping from Cisco ASA side lan to PA ...
- 4,389
0
votes
0
answers
117
views
static IP multicast routing with IPSEC
for a specific application, I need to route a multicast flow with IPSEC (we use a CISCO ASA 5508 firewall), I am not a network expert then I will try to explain as best as I can our issue
I don't need ...
- 1
0
votes
0
answers
96
views
Does multicast over tunnels (e.g., GRE) require IGMP/MLD?
When subscribing to a multicast group on a tunnel device such as a GRE tunnel, are you supposed to participate in IGMP/MLD over that tunnel in order to announce your membership in the multicast group? ...
- 327
4
votes
2
answers
1k
views
MTU/MSS Oddness?
We have an IKEv2 IPSec tunnel between two Sophos XG Firewall appliances in a corporate system for a remote site.
We don't have any specialized MSS or MTU settings other than what the IPSec tunnel ...
- 181
0
votes
1
answer
333
views
Cisco IPsec VPN tunnel problem
I have a problem with VPN configuration. This is the topology I created:
First updated licenses to make the VPN available:
license boot module c1900 technology-package securityk9
IPsec Router ...
- 3
0
votes
0
answers
214
views
Editing a crypto map with multiple entries
We're attempting to bring up an IPSEC tunnel with a Vendor. An engineer created the crypto map and wasnt able to establish a connection. I edited the entry to change the diffie-hillman group and the ...
- 11
0
votes
2
answers
359
views
Why cant't IPSec's Transport Mode ESP be used in NAT64 although ESP doesn't sign the new IP header?
In RFC6146 stated:
Any protocols that protect IP header are incompatible with NAT64. This
implies that end-to-end IPsec verification will fail when the
Authentication Header (AH) is used (both ...
- 27
1
vote
1
answer
125
views
IKEv2 notification payload regarding IKE SA
I am puzzled about two paragraphs regarding a notification payload in section 3.10 of RFC7296. There you can find the following:
o Protocol ID (1 octet) - If this notification concerns an existing
...
- 161
2
votes
1
answer
1k
views
Is an IPSec connection between 2 devices behind NAT possible?
We have tens of IPSec connections between our office and customer site's. We use an extra router in the customer network (so behind NAT) to initiate the connection to our office where a PFSense router ...
- 221
0
votes
2
answers
202
views
Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?
This question is about encryption in data communications, defined broadly to include:
Line scrambling at layer 1
MACsec at layer 2
IPsec at layer 3
TLS at layer 4
etc.
All of these encryption ...
- 339
0
votes
1
answer
62
views
Access IPSec site from another IPSec site
Our company delivers, installs and maintains custom build hardware at customer sites. In all cases the delivered setup contains at least 1 server and 2 network devices. To keep the control over the ...
- 221
0
votes
2
answers
114
views
Setup IPSEC in Hub/Spoke fashion
I'm trying to setup IPSEC tunnels in a hub/spoke type fashion. I've emulated this in GNS3 by creating three sites. Each site uses an IOSv router as it's WAN router. I'm using site 2 as the hub and ...
- 273