Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

network cutover for remote site from L2 to L3 over IPSec tunnel

I have been trying to cutover one of our remote sites (A) to the new ISP we have purchased. The existing setup is utilizing L2 through another remote site (B) and coming back to the main campus. The ...
0
votes
3answers
41 views

Site-to-site IPSec tunnel over Load balancer

I'm having a following topology Could this be archived? I've configured this network, but routing between the two VLAN-s are not working. Using Ubiquity Edge X routers. Could this be archived with ...
0
votes
0answers
22 views

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6?

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6 ?
0
votes
1answer
53 views

Is it possible to setup IPsec behind NAT without port forwarding?

We want to setup a IPsec connection between customer sites and our office so we can manage the hardware we place at customer sites (e.g. barriers). Its important that the VPN connection stays up all ...
1
vote
2answers
52 views

IPSec Tunnel Mode

Assuming an organisation has 2 offices at two different locations and needs secure communication between them. As far as I understand IPSec, we can use tunnel mode to provide end to end encryption for ...
0
votes
3answers
42 views

Do i need VLAN per customer when i want to give users (secure) access to specific customer sites

This question is a follow up on this question. We are currently working on the network design, nothing is implemented yet. Our network will exist out of our own (internal) network and lot of customer ...
0
votes
1answer
42 views

IPSEC Authentication Header Query

I was going through the RFC 4302, to understand the AH Header. In sec 2.2, Payload Length, it says: This 8-bit field specifies the length of AH in 32-bit words (4-byte units), minus "2". I am ...
2
votes
2answers
232 views

IKEv2 tunnel between ASA and Mikrotik

Trying to move from pfSense to Mikrotik for an office router, and the only stumbling block is maintaining a site-to-site IPSEC tunnel between it and our Cisco ASA. The settings all look correct to me, ...
0
votes
1answer
46 views

Create IPSEC VPN between three Routers?

I'm attempt to build essentially an IPSEC tunnel mesh between three Cisco IOSv routers. I've been able to build an IPSEC tunnel between two directly connected routers but once I add the third router ...
0
votes
0answers
34 views

Hub and spoke IPSec in pfsense

I have 9 different sites and one HQ site where all 9 remote sites connect to via IPSec VPN. All are pfsense firewalls. I want to allow traffic between site 2, 3 and 4. But I do not want to configure ...
0
votes
1answer
103 views

Cisco ASA IPSec Site-to-Site VPN Rx Bytes not increasing

I have IPsec Site-to-Site VPN from my ASA to customer. After customer complain about VPN down, I reset the tunnel now I can see Login time duration 12h:34m Byte TX is 543240 and Byte Rx is 0. What ...
0
votes
0answers
19 views

ipsec site to site vpn phase1 and phase2 negotiation

in ipsec site to site vpn, how initiator and responder negotiates in phase1 and phase2 and what is security association in phase1 and phase2 ? How ike correlate with oakley, Isakmp and Skeme ?
2
votes
0answers
32 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
0
votes
0answers
10 views

Ipsec connection and nat only one site [duplicate]

There are two companies and two of them connected to each other with İPsec vpn. Company A has a server and company B want to reach to company A server. Which company need to configure nat on its ...
0
votes
1answer
610 views

IPSEC Phase 1 error

Was does the MM_NO_STATE usually mean when having errors bringing phase 1 up? IPv4 Crypto ISAKMP SA dst src state conn-id status X.X.X.122 X.X.X.107 MM_NO_STATE ...
0
votes
0answers
40 views

QoS over IPSec Site-to-Site VPN: Concerns and Questions

(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
1
vote
1answer
39 views

IPSec does not work via backup interface

Cisco ASA 5506-X connected to two ISP - main and standby channel, interfaces outside_1 and outside_2. IPSec works via outside_1, but does not work via outside_2, if outside_1 down. At this moment ...
2
votes
1answer
50 views

Cisco 5505 ASA firewall Ipsec vpn- Can connect two outside different public ip to two different local subnets

I only get one IPSEC vpn connection up but not the other. Link to access configs on Google: https://drive.google.com/open?id=1yB_yIWvJ51A0UeNbkAEiTH9YMIEipqy_ profile1- outside interface - 66.x.x.x ...
0
votes
1answer
24 views

Site-to-Site IPSEC through load balancer with persistence

what I'm trying to achieve is a site to site IPSEC tunnel going through a load balancer, (both sites have pfsense and balancer is f5 big ip) the reason why i'm trying to do that is because: - Site A ...
0
votes
1answer
19 views

IP-Sec VPN Tunnel Established Between 2 Remote Machines. Why Can't Machines In Their Subnets Connect Across? [closed]

Have 2 Remote Ubuntu Machines in different subnets. one: 192.168.1.0/24 Two: 192.168.2.0/24 Established VPN tunnel between 2 machines, 1 in each subnet. Their IPs: Public IPs 1.1.1.1 2.2.2.2 ...
0
votes
2answers
369 views

Cisco ASA IKE Receiver: Runt ISAKMP packet discarded on Port 500

I have lots of ikev1 tunnel running on our production Cisco ASA5585 and today i have configured ikev2 tunnel for one of our new customer and i have started seeing following error, and not sure what is ...
0
votes
0answers
37 views

IKE Main Mode - Dynamic peers

So i searched for some time now, read the https://tools.ietf.org/html/rfc2409RFC and simply couldn't find an answer to why Main Mode needs static adresses. The RFC states Aggressive Mode does not ...
2
votes
2answers
65 views

SRX to ASA IPSec troubles

we built a VPN between partner's Cisco ASA (unknown version) and my Juniper SRX 340. The tunnel seems to go up properly: root@fw01> show security ike security-associations node0: ----------------...
1
vote
1answer
166 views

Cisco dVTI - Virtual-Access interface has no IP address

i'm struggeling with some dVTI Issue on a Cisco ASR1000 box. here is my configuration for the hub site: crypto keyring FOO-KEYRING pre-shared-key hostname r2-foo key iawg8b32hah ! crypto isakmp ...
1
vote
0answers
35 views

Chckpoint Remote Access VPN Multiple ISP external interface [closed]

I'm in a situation where I have to suggest the best solution when client has two ISP connected to a checkpoint firewall cluster. AFAIK, we cannot activate or make use of two external interfaces for ...
0
votes
3answers
123 views

IPSec VPN timers query

I have a couple of queries related to the IPSec VPN and I believe someone would clarify my doubts. Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating? Why ...
4
votes
0answers
551 views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
0
votes
1answer
59 views

IPsec VPN route in Checkpoint

I have created a ipsec VPN from site A (Cisco) to Site B (checkpoint R77.20). At site B, i have a static 1-1 NAT applied: ipx --ipy Tunnel is live and connection up; I can telnet my site B system ...
1
vote
0answers
49 views

IPsec tunnel with multiple networks NATed [closed]

I'm trying to set up an IPsec connection between two sites: our Azure network and our client's local network. To be flexible and avoid any current or potential future IP range overlappings I wand to "...
0
votes
1answer
314 views

How do you define interesting traffic using an IPSec Profile on a Cisco router?

I apologize if this is a duplicate, but I'm having difficulty figuring out how to define interesting traffic on a Cisco router using an IPSec Profile referenced by a tunnel interface. The old-school ...
1
vote
1answer
564 views

Traceroute through IPSec tunnel

askk Hi. When I do traceroute from host 192.168.11.0/24 to the server 10.0.0.0/24, which is site B. When the packets get into the public area it show Request timed out (as shown in this figure). I'm ...
-1
votes
1answer
69 views

GRE over IPSec Transport vs. Tunnel Mode

I have a misunderstanding, in this article, Figure 4-9, in Transport Mode, first header (IPsec Hdr), is correct? Should not be GRE IP Hdr? https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/...
-1
votes
1answer
117 views

Site-to-site IPsec and rerouting to another IPsec tunnel

We have three different geo sites (SITE1, SITE2 and SITE3) and each site has PFSense firewall installed. Sites have been connected together with IPSec tunnels. Also Site2 is connected to customer ...
4
votes
2answers
110 views

Is Cisco IPsec different from ordinary IPsec?

Is Cisco IPsec different from ordinary IPsec? Although Windows 10 has built-in VPN support for L2TP/IPSec, it does not support IPSec provided by Cisco. Thus, we generally need to install hand-made ...
2
votes
0answers
390 views

GRE over IPsec problem

I'm trying to build a GRE Tunnel with IPSec encryption between two routers, but I keep getting error message saying "%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet..." Immediately I ...
1
vote
1answer
50 views

VoIP, IPsec configuration

I have a topology in GNS3 with an IPsec VPN tunnel between C1 and C2 (https://imgur.com/dnNkssU). In clients networks i am configured a CME and a Softphone. When i make a call the quality is very bad. ...
0
votes
1answer
313 views

Can both IPsec endpoint be configured as the initiator?

Then configuring an IPsec tunnel, I can usually set if the device should act as the initiator or the responder (or even both). However, what would happen if both endpoint are configured as the ...
2
votes
1answer
165 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
3
votes
1answer
265 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
1
vote
1answer
1k views

Keep Cisco site-to-site tunnel up permanently

I have Cisco ASA site-to-site tunnel with remote and which i don't have control. I have following config: crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 ...
1
vote
1answer
396 views

IPSec route-based vpn st0 interface

As i know, the st0 interface is used when the gateways are configured with route based VPN. But my question is, say below is the topology A<---->B<---->C<---->D A and D are hosts, B and C ...
0
votes
1answer
41 views

What is the reason for encrypting Identity field under IPsec phase1?

Why Identity fields are encrypted in IPsec phase 1 around packet 5/6 ? provided that the Identity field contains IP of either end. Does it has any significance ? Does it holds anything different then ...
0
votes
0answers
74 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
-2
votes
1answer
312 views

IPSec SA being Unidirectional

From what I’ve read, IKE SAs are Birectional and IPSec SAs are unidirectional. But if the same proposals are to be agreed by both the ends, say protocol esp, Authentication algorithm as hmac-sha1-...
0
votes
0answers
48 views

IPSec Tunnel is up but no Communication with End Systems?

I need help for IPSec tunnel. Currently, I am working on a small task to create remote access between my laptop and office router, in order to access the office LAN network. IPSec tunnel is working ...
1
vote
1answer
87 views

IPSec tunnel between 2 LANs using HSRP in each side

This is my first post here, so tell me if there's something I'm doing wrong. I'm currently working with another IT student on our end of degree project and we're building our network in PT. Our ...
4
votes
1answer
429 views

How IPsec tunnel mode work without GRE

IPsec tunnel mode encrypt a whole IP packet and sends it as the payload of another IP packet. I have always used GRE as the encapsulation layer when doing IPsec encryption. However, how could I have ...
0
votes
0answers
317 views

Query on Cisco IPsec Licensing, HSEC-K9

I'm currently debugging an issue with IPsec tunnels and it seems like one of our client's NW engineers didn't install the HSEC-K9 license. The issue is that the new IPsec tunnels are not coming up ...
3
votes
1answer
232 views

High Availability for ISR 4431 IPSec VPNs

I have the following lab setup in GNS3. R1 & R2 are VPN endpoint at my datacenters and R3 is simulating a remote site. What i'm trying to accomplish is having one tunnel from R3 to the ...
1
vote
0answers
212 views

Why do the tunnel protocol on these two router show different values

Two routers R1 and R2 have a tunnel built between them in the 103.103.103.0/24 network. The end point of the tunnel are 75.75.75.2(on R1) and 76.76.76.2(on R2). Can anyone explain why does the Tunnel ...

1
2 3 4 5 6