Questions tagged [ipsec]
Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.
292
questions
1
vote
1
answer
52
views
Juniper MX with MS-MIC and ipsec performance
I've set up the gre over ipsec tunnel between SRX650 and MX5 (MS-MIC onboard). While SRX is able to serve ipsec tunnels traffic at about 100-200 Mbit/sec to other SRXes, I can get only about 1.5 Mbit/...
- 243
0
votes
0
answers
36
views
IPsec no working properly
I want to set an IPsec between two routers similar to the one in this lab, however the client on router EAST is NATted with the public IP 98.76.65.42
on the local side
EAST(config)# access-list 110 ...
- 3
0
votes
1
answer
40
views
IPSec over L2GRE scenario
I wanted to know if this is a valid scenario and if it is possible to implement.
There is a remote site A. and a Data center site B. Both A and B have a edge router which runs an IPSec tunnel. An ...
- 101
0
votes
1
answer
60
views
How to configure IDr on Cisco ASA for AWS IPsec tunnels
I am currently facing an issue while attempting to establish IPsec tunnels between AWS and a Cisco ASA firewall. The AWS tunnel logs indicate that the Identity Resolution checks are failing, ...
0
votes
1
answer
88
views
DH groups support for isakmp policy
When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are ...
- 57
0
votes
2
answers
144
views
IPsec PFS Confusion
I'm reading conflicting things about how PFS works in IPsec. Some sources say it's simply a renegotiation of the Phase 1 IKE/ISAKMP SA that ignores the original IKE/ISAKMP SA lifetime value and that ...
- 1
1
vote
1
answer
101
views
VPN doesn't work
I'm trying to configure VPN between 2 routers:
R1: public IP is 200.0.0.6/30 on S0/0/1, private IP are 10.0.0.0/8 and 20.0.0.0/8
R3: public IP is 210.10.0.6/30 on S0/0/0, private IP is 192.168.3.0/24
...
- 27
0
votes
0
answers
83
views
Cisco IPSec VTI model not working as expected
I'm trying to new IPSec connection recommended by Cisco,
here
Now i reserved a DevNet CML Sandbox and using the IOS-XE routers in there, which is Dist-RT01 and Dist-RT02.
Since CML sandbox using mgmt ...
- 1
1
vote
0
answers
25
views
Complicated bridge between 2 servers [closed]
I have 3 servers:
comp_a, comp_b, comp_c
comp_a ([eth0 «10.15.14.55»]) 10.0.0.0/8 <———> comp_b ([eth0 «10.15.27.61», eth1 «10.15.26.61»] [eth1 «10.15.26.61» ]) <——VPN IPS (left = 10.15.0.0/16 ...
- 11
0
votes
2
answers
742
views
How to solve high ping "spikes" to pfSense when ipSec connections are active?
Background information:
We have latency/freeze problems with our pfSense. To be able to answer the question i will first give some general background information:
We run pfSense V2.6.0 on following ...
- 219
0
votes
1
answer
546
views
Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes
My end of the tunnel is on an ASAv in AWS. (version 9.14)
show crypto isakmp sa
4 IKE Peer: 212.239.x.y
Type : L2L Role : responder
Rekey : no State : ...
- 213
1
vote
2
answers
2k
views
Is it possible to implement IPSEC over MPLS?
On a high level, I understand that the data-traffic(original ip packet) is encrypted and encapsulated in ESP header (imagine a IPSEC in tunnel mode). Generally, this IPSEC tunnel is triggered by ...
- 1,124
0
votes
0
answers
103
views
IP pkt len in ESP transport mode? How to validate ESP pad length?
What will be the value of packet-length/Total length field in the IP headers for ESP packets in transport mode?
For instance, in tunnel mode below are the values:-
Outer-IP header's Packet length = ...
- 1,124
0
votes
2
answers
398
views
IPSEC ESP tunnel mode - Are the ip addresses in outer IP HDR same as addresses in inner encrypted IP HDR?
Am trying to understand how IPSEC in tunnel mode achieves the VPN functionality. I understand that the IP header and payload along with TCP/UDP headers are encrypted. But, if the src and dst addresses ...
- 1,124
2
votes
2
answers
77
views
Why does IKEv2 forbid dynamic address updates for hosts behind NAT?
In RFC7296, Section 2.23 it is written:
There are cases where a NAT box decides to remove mappings that are
still alive (for example, the keepalive interval is too long, or the
NAT box is rebooted). ....
- 123
0
votes
1
answer
95
views
Switching Internet connection on Cisco ASA
I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
- 155
2
votes
2
answers
2k
views
FortiGate: IPSec peer-to-peer and two remote peers
I have a FortiGate firewall in the main office and some branches with Cisco ASA. An IPsec tunnel runs between the main office and each branch. Some branches have two ISP - main and reserve. For ...
- 155
1
vote
0
answers
205
views
Diffie-Hellman with PSK/PKI in the context of IKEv1
It seems I fail to understand few things about DH's functionality in the context of IKEv1.
A little bit of context first:
During IKE Main Phase, with the 3rd and 4th messages, the peers each exchange ...
1
vote
1
answer
79
views
OSPFv3 Authentication IPSEC SPI/Logging issues - Can you filter out logs?
I'm running into a problem with our Cisco ASR-1002HX and ASR-1006X. I have a mix of Juniper and Cisco routers all configured exclusively with IPv6. All of our routers are in the same ospfv3 area 0. We ...
- 157
1
vote
1
answer
2k
views
IPSec IKEv2 on pfSense: "parsed INFORMATIONAL request 2 [ N(AUTH_FAILED) ]"
I am trying to setup an IPSec IKEv2 VPN Network on a pfSense. The pfsense is situated directly behind the modem. I connect to it by a static IP address. There is no double NAT. I followed this ...
- 11
1
vote
2
answers
2k
views
Why does IPsec not support Multicast/Broadcast?
Many sources site GRE as supporting broadcast/multicast and IPsec does not. Both GRE and IPsec are merely tunneling protocols. Therefore there is nothing inherent about tunneling protocols which ...
- 127
2
votes
2
answers
670
views
Site-to-Site VPN with Sophos XG using tunnel interface
So I have configured a Sophos XG site-to-site vpn according to this document:
https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/...
6
votes
4
answers
3k
views
What's the advantage of IPSec over TLS/DTLS? [closed]
What's the benefit of IPSec over TLS and DTLS ? If someone's goal is to assure authentication, integrity and confidentiality, can't he/she simply encrypt the content with the two last protocols (on ...
- 161
0
votes
2
answers
163
views
Cisco ASA access-lists and net config
Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
0
votes
1
answer
161
views
VPN/IPsec router support in Packet Tracer
I would like to know, if a router doesn't support VPN (meaning it can't be used as a VPN server) can it still route an IPsec packet?
And which router I should use as a server for IPSec (AH tunnel mode)...
- 1
1
vote
0
answers
892
views
IKEv2 between Cisco router and Google cloud VPN
Hey I'm trying to create a tunnel between cisco router and google cloud vpn (client site) but the connection is stuck on stage 2 (UP-IDLE), need help where the problem may lie.
Some debug that I get ...
- 11
1
vote
0
answers
306
views
UNIFI USG GATEWAY IPSEC OVER L2TP VPN [closed]
At my office I have a Unifi USG Gateway that currently has 3 IPSEC VPN Tunnels (Lan-To-Lan VPN) configured. I also have a L2TP Remote VPN Network configured so that when I'm outside of my office I can ...
- 111
1
vote
0
answers
2k
views
Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]
I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL.
Can ...
- 255
1
vote
0
answers
6k
views
Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]
I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel.
[PA]-----------(internet)-----------[Cisco ASA]
If i ping from Cisco ASA side lan to PA ...
- 4,371
0
votes
0
answers
103
views
static IP multicast routing with IPSEC
for a specific application, I need to route a multicast flow with IPSEC (we use a CISCO ASA 5508 firewall), I am not a network expert then I will try to explain as best as I can our issue
I don't need ...
- 1
0
votes
0
answers
78
views
Does multicast over tunnels (e.g., GRE) require IGMP/MLD?
When subscribing to a multicast group on a tunnel device such as a GRE tunnel, are you supposed to participate in IGMP/MLD over that tunnel in order to announce your membership in the multicast group? ...
- 327
4
votes
2
answers
1k
views
MTU/MSS Oddness?
We have an IKEv2 IPSec tunnel between two Sophos XG Firewall appliances in a corporate system for a remote site.
We don't have any specialized MSS or MTU settings other than what the IPSec tunnel ...
- 181
0
votes
1
answer
275
views
Cisco IPsec VPN tunnel problem
I have a problem with VPN configuration. This is the topology I created:
First updated licenses to make the VPN available:
license boot module c1900 technology-package securityk9
IPsec Router ...
- 3
0
votes
0
answers
182
views
Editing a crypto map with multiple entries
We're attempting to bring up an IPSEC tunnel with a Vendor. An engineer created the crypto map and wasnt able to establish a connection. I edited the entry to change the diffie-hillman group and the ...
- 11
0
votes
2
answers
303
views
Why cant't IPSec's Transport Mode ESP be used in NAT64 although ESP doesn't sign the new IP header?
In RFC6146 stated:
Any protocols that protect IP header are incompatible with NAT64. This
implies that end-to-end IPsec verification will fail when the
Authentication Header (AH) is used (both ...
- 27
1
vote
1
answer
95
views
IKEv2 notification payload regarding IKE SA
I am puzzled about two paragraphs regarding a notification payload in section 3.10 of RFC7296. There you can find the following:
o Protocol ID (1 octet) - If this notification concerns an existing
...
- 161
2
votes
1
answer
954
views
Is an IPSec connection between 2 devices behind NAT possible?
We have tens of IPSec connections between our office and customer site's. We use an extra router in the customer network (so behind NAT) to initiate the connection to our office where a PFSense router ...
- 219
0
votes
2
answers
184
views
Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?
This question is about encryption in data communications, defined broadly to include:
Line scrambling at layer 1
MACsec at layer 2
IPsec at layer 3
TLS at layer 4
etc.
All of these encryption ...
- 339
0
votes
1
answer
62
views
Access IPSec site from another IPSec site
Our company delivers, installs and maintains custom build hardware at customer sites. In all cases the delivered setup contains at least 1 server and 2 network devices. To keep the control over the ...
- 219
0
votes
2
answers
105
views
Setup IPSEC in Hub/Spoke fashion
I'm trying to setup IPSEC tunnels in a hub/spoke type fashion. I've emulated this in GNS3 by creating three sites. Each site uses an IOSv router as it's WAN router. I'm using site 2 as the hub and ...
- 273
1
vote
1
answer
354
views
Confusion about Route based IPSEC site-site vpn and policy based IPSEC site-site VPN
I am confused about the major difference between a policy-based VPN and routed-based site-site Vpn
- 11
1
vote
1
answer
402
views
Juniper QFX Site to Site VPN
Im trying to setup a site to site vpn between two Juniper QFX5110's. Each end of the link is on the same subnet (so directly connected switches over dark fibre). I have configured each physical ...
- 25
0
votes
2
answers
87
views
IPSEC between two offices with SAME local networks. How should I do nat? [duplicate]
I have two spokes with same local networks and want to do IPSEC between them.
When I try to ping 172.17.214.111 from 192.168.5.0 (from right side to left side) I see packet on Cisco router and I see ...
- 255
0
votes
3
answers
170
views
But confused about SSL VPN and IPsec Site -Site VPN
What might be difference between sslvpn and site-site vpn . Which one among two is secure and it's significance
user69946
0
votes
0
answers
49
views
network cutover for remote site from L2 to L3 over IPSec tunnel
I have been trying to cutover one of our remote sites (A) to the new ISP we have purchased.
The existing setup is utilizing L2 through another remote site (B) and coming back to the main campus.
The ...
- 11
0
votes
3
answers
875
views
Site-to-site IPSec tunnel over Load balancer
I'm having a following topology
Could this be achieved? I've configured this network, but routing between the two VLAN-s are not working. Using Ubiquity Edge X routers.
Could this be archived with ...
- 3
0
votes
0
answers
100
views
How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6?
How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6 ?
0
votes
1
answer
2k
views
Is it possible to setup IPsec behind NAT without port forwarding?
We want to setup a IPsec connection between customer sites and our office so we can manage the hardware we place at customer sites (e.g. barriers). Its important that the VPN connection stays up all ...
- 219
1
vote
2
answers
128
views
IPSec Tunnel Mode
Assuming an organisation has 2 offices at two different locations and needs secure communication between them. As far as I understand IPSec, we can use tunnel mode to provide end to end encryption for ...
- 13
0
votes
3
answers
151
views
Do i need VLAN per customer when i want to give users (secure) access to specific customer sites
This question is a follow up on this question. We are currently working on the network design, nothing is implemented yet.
Our network will exist out of our own (internal) network and lot of customer ...
- 219