Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

1
vote
1answer
41 views

VoIP, IPsec configuration

I have a topology in GNS3 with an IPsec VPN tunnel between C1 and C2 (https://imgur.com/dnNkssU). In clients networks i am configured a CME and a Softphone. When i make a call the quality is very bad. ...
0
votes
1answer
24 views

Can both IPsec endpoint be configured as the initiator?

Then configuring an IPsec tunnel, I can usually set if the device should act as the initiator or the responder (or even both). However, what would happen if both endpoint are configured as the ...
2
votes
1answer
49 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
3
votes
1answer
58 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
1
vote
1answer
103 views

Keep Cisco site-to-site tunnel up permanently

I have Cisco ASA site-to-site tunnel with remote and which i don't have control. I have following config: crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 ...
1
vote
1answer
47 views

IPSec route-based vpn st0 interface

As i know, the st0 interface is used when the gateways are configured with route based VPN. But my question is, say below is the topology A<---->B<---->C<---->D A and D are hosts, B and C ...
0
votes
1answer
33 views

What is the reason for encrypting Identity field under IPsec phase1?

Why Identity fields are encrypted in IPsec phase 1 around packet 5/6 ? provided that the Identity field contains IP of either end. Does it has any significance ? Does it holds anything different then ...
0
votes
0answers
53 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
-2
votes
1answer
49 views

IPSec SA being Unidirectional

From what I’ve read, IKE SAs are Birectional and IPSec SAs are unidirectional. But if the same proposals are to be agreed by both the ends, say protocol esp, Authentication algorithm as hmac-sha1-...
0
votes
0answers
38 views

IPSec Tunnel is up but no Communication with End Systems?

I need help for IPSec tunnel. Currently, I am working on a small task to create remote access between my laptop and office router, in order to access the office LAN network. IPSec tunnel is working ...
1
vote
1answer
57 views

IPSec tunnel between 2 LANs using HSRP in each side

This is my first post here, so tell me if there's something I'm doing wrong. I'm currently working with another IT student on our end of degree project and we're building our network in PT. Our ...
3
votes
1answer
191 views

How IPsec tunnel mode work without GRE

IPsec tunnel mode encrypt a whole IP packet and sends it as the payload of another IP packet. I have always used GRE as the encapsulation layer when doing IPsec encryption. However, how could I have ...
0
votes
0answers
60 views

Query on Cisco IPsec Licensing, HSEC-K9

I'm currently debugging an issue with IPsec tunnels and it seems like one of our client's NW engineers didn't install the HSEC-K9 license. The issue is that the new IPsec tunnels are not coming up ...
2
votes
1answer
53 views

High Availability for ISR 4431 IPSec VPNs

I have the following lab setup in GNS3. R1 & R2 are VPN endpoint at my datacenters and R3 is simulating a remote site. What i'm trying to accomplish is having one tunnel from R3 to the ...
1
vote
0answers
60 views

Why do the tunnel protocol on these two router show different values

Two routers R1 and R2 have a tunnel built between them in the 103.103.103.0/24 network. The end point of the tunnel are 75.75.75.2(on R1) and 76.76.76.2(on R2). Can anyone explain why does the Tunnel ...
1
vote
1answer
28 views

Can a VPN tunnel between routers be built with different tunnel protocol on both ends?

I have two routers and the tunnel between them is up and working well. Router1 has GRE/IP as the protocol on its tunnel interface, and as for Router2 the tunnel interface is working with IPSEC/IP. Can ...
3
votes
1answer
156 views

Azure VPN vs. Cisco ASA

I have a Cisco 5516-x with v9.7(1)21 on my end and I am trying to create a working VPN to Azure. It looks to me like phase1 goes well but phase2 fails due to policy mismatch. Any suggestions for how ...
2
votes
1answer
39 views

Why aren't we encrypting data on Network level instead of transport level when using e.g. HTTP [closed]

Why we are bothering to encrypt our data on a transport level, instead of just doing that on a network level with e.g. IPSec and get rid of the need to to that in upper layers. For example instead of ...
0
votes
1answer
55 views

Can I use the same IPsec tunnel for two VRF?

I have two routers linked by two logical links in two different VRF. I should move one router to another site and use Internet to keep the same connectivity. Since I use private IP addresses in my VRF,...
1
vote
2answers
56 views

AWS site-to-site VPN and multiple account VPC connections

I've configured a site-to-site VPN from our firewall (watchguard) to AWS. Now, how can I connect Account A with Account B? I've already an OpenVPN server in account A to which account B connects (...
3
votes
2answers
441 views

IKE phase 1 and phase 2

Was going through the IKE phase 1 and phase 2. I have some questions regarding the same which is bothering me with respect to main mode and quick mode.Please correct me if i go wrong somewhere. Phase ...
4
votes
1answer
181 views

Use cases for GRE over IPSEC

I'm trying to understand use cases for GRE over IPSEC. In the diagram below, each site uses GRE to encapsulate multicasts associated with OSPF. (There is still a requirement to configure SAs between ...
1
vote
0answers
143 views

AWS tunnel TCP retransmissions and DUP ACKs

I have a IPsec tunnel from my firewall towards AWS, the tunnel is up in both phases. If I run traffic sniffer in the firewall, I can see interesting traffic going through, but there are MANY TCP ...
1
vote
1answer
41 views

Shared secret key for Diffie-Hellman key exchange

From what i have learnt,in Asymmetric key there is public key and a private key. For instance: Step 1: Alice and Bob get public numbers P = 23, G = 9 Step 2: Alice selected a private key a = 4 and ...
3
votes
0answers
66 views

IPSec Tunnel not coming up: Issue with ACL?

I'm trying to bring up a IPsec tunnel between router and a bridge. I can see the Ipsec tunnel configurations are up and running but I think I have made a mistake in the ACL and hence the encr and decr ...
2
votes
1answer
157 views

how security association (SA) is established?

I'm a newbie in networking, still struggling to understand some concepts. I was reading a text describes security association (SA) in VPN. Whenever router R1 needs to construct an IPsec datagram for ...
4
votes
1answer
98 views

Pass traffic from remote access to site to site tunnel

I have situation where remote access ipsec client have to connect to ASA firewall to send and receive traffic using site to site tunnel on the same ASA, in the logs I am seeing packets dropped as it ...
1
vote
1answer
80 views

Outbound NAT for single host behind an ASA located over an IPSEC tunnel [closed]

I have these two nets connected over the public internet with ASA 5510s. 192.168.0.0 < -- ASA1 ---> Internet <--- ASA2 --> 192.168.5.0 Each net does either a simple dynamic or static nat ...
3
votes
1answer
283 views

Junos IPSEC Tunnel to Azure & TCP-MSS

I am configuring a Juniper SRX 300 Series to establish an IPSEC tunnel to Azure. The Azure Vnet range is 192.168.10.0/23 The local range is 10.49.236.0/24. The configuration: (relevant bits with ...
2
votes
1answer
450 views

L2TP IPSec Remote VPN - Many users connecting remotely from same access

Can someone explain to me, why isn't possible to connect 2 or more clients to a VPN server when the users are behind the same public IP (NAT/PAT). What I mean is: if there is already a user connected ...
1
vote
1answer
409 views

Result of running `restart ipsec-key-management`

I have Juniper SRX 1400 which is used mainly for IPSEC tunnels. And now I facing a bug in firmware with ID PR1085657 (IKE doesn't come up when the SRX is the initiator). Possible solutions to this is ...
2
votes
1answer
544 views

Site-to-site IPSEC for multiple peers with dynamic IP on Juniper SRX

Looking for possible solution. I have Juniper SRX 1400 (12.1X47-D20.7) with static WAN IP in data-center and multiple sites with dynamic WAN IP addresses. I need to build with them site-to-site VPN's....
2
votes
0answers
319 views

RSA key not working with trustpoint used for IPSec

I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup. Importing is ...
2
votes
1answer
125 views

Latency-sensitive channel bonding

One of our satellite offices is connected by a Satellite connection with no other high bandwidth option. Reliability is good and bandwidth is acceptable (50/10 MB/s), but latency is making, ssh, VPN ...
2
votes
2answers
721 views

GRE-IPsec Tunnel between Cisco Router and a Linux Router

I am trying to create a GRE/IPsec tunnel between Cisco router and a Linux Router. The tunnel is UP and active, but when I do a "show crypto session" on the Cisco router the Active SA's keep on ...
5
votes
1answer
3k views

IPSec failure with `IKE message failed its sanity check or is malformed`

I've been battling with my IPSec configuration for some days (with foolish deadline looming) and would like to ask for help with it failing its initial connection. It's designed as client-to-router ...
2
votes
0answers
31 views

encryption gateway vs domain and source ip issues [closed]

(This is the same setup as a previous question.) My VPN connection was no longer working (for ~4h), so I called the remote end's tech support. While we were talking, the link mysteriously started ...
0
votes
1answer
329 views

Configuring IPsec VPN and TTL

I have two sites, each using their own firewall. Once a Cisco Meraki, another a Cisco ASA. The two sites use IPsec to establish a VPN tunnel. The Question: If each of the two sites have different ...
0
votes
2answers
81 views

IPSec - NAT-T inner/outer IP of the gateway?

I was configuring an IPSec VPN and somehow I can't figure out what the inner/outer IP of my gateway would be. Have a look at this image : Imagine I have my site-to-site VPN, with my gateway having ...
-1
votes
3answers
389 views

Connecting to subnets with IPSec VPN, how to route?

I set up a site-to-site VPN between two TP-Link routers, following the instructions here: https://www.tp-link.com/ae/faq-380.html . The VPN is based on IPSec. Now both routers say that the IPSec ...
1
vote
1answer
283 views

Cisco VRF aware dynamic VTI based IPSEC VPN

im struggeling on a Cisco IPSEC Konfiguration. My aim is to terminate spoke sites behind CGN gateways into a MPLS L3VPN Network via IPSEC tunnels. The router at hub site is a ASR1k running IOS XE 3....
1
vote
1answer
421 views

ASA VPN Tunnel NAT Issues

I've been trying to jump through two tunnel. A Customer has a cloud solution which we need access to. Since we already have a vpn site2site tunnel to the customer we can already access his LAN. What ...
4
votes
1answer
80 views

Confused on perfect forward secrecy, someone kindly help me

i just read following article In IPsec VPN, how is the pre-shared key encrypted? got knowledge about phase 1 also basic line over PFS: for every new negotiation of Phase 2 SA the 2 gateways must ...
1
vote
1answer
97 views

IPv6 VPNs source address selection

Say I have the following IPv6 prefix assigned to me by my ISP : 2a01:1000:1000::/48 with 2a01:1000:1000::1/48 assigned to my VPN server. I set up a VPN with a /64 from that block to assign to my ...
3
votes
1answer
921 views

SonicWall is dropping encrypted packets with error “sonicwall ipsec vpn decryption failed selector check error”

I have implemented a Site-to-Site IPsec tunnel between a Juniper SSG firewall and a SonicWall. However, any traffic that I send over the tunnel gets dropped on the SonicWall with an error saying ...
3
votes
3answers
288 views

Layer 3 tunnel with Dynamic IP address

I want to ask whether it is possible to configure Layer 3 Tunnel with the two end points/interfaces have dynamic IP address? If the interface IP change, the tunnel will have to be re-negotiated, is ...
1
vote
2answers
3k views

Cisco ASA MTU vs TCP MSS

I am trying to set jumbo MTU for Cisco ASA 5585 and I did following: asa1/pri/act(config)# mtu inside 9000 INFO: Jumbo frames should be enabled to receive packets more than 1500 MTU Use '...
3
votes
1answer
175 views

ASA as a local DNS resolver

I have an site to site VPN access configured by ASAs. My remote site needs to connect to the domain through the tunnel which will required DNS located on the main site. I would like to use DNS server ...
4
votes
1answer
2k views

IPsec Tunnel is showing decrypt packets counter but 0 encryption packets: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

I have just configured the IPSEC tunnel between my router and the Access point.I could see that the Tunnel has came up and Active in both sides. However,When I checked the "Show cyrpto ipsec sa" ,I ...
1
vote
1answer
278 views

PBR not working as expected

EDITED: ADDED FULL ROUTER CONFIG I have a cisco 2921. It uses EIGRP to learn its routing table and has no static default routes set up. I would like to keep it that way. The default route (learned ...