Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
0 votes
1 answer
51 views

Why is IPsec transport mode "vulnerable" for not having integrity of variable fields? Why is this so important?

With IPsec transport mode we CAN'T have integrity of variable fields (eg TTL and checksum). Why is it a problem? Is it? What could be the attack? I think TTL expire or checksum modification (so both ...
allexj's user avatar
  • 1
0 votes
1 answer
41 views

Cisco ASA L2TP/IPsec split-tunnel not working for public Internet

I'm testing a setup using ASA to provide VPN over L2TP/IPSec PSK to support native IPSec clients such as iOS, Android, MacOS, Windows, etc. The issue I'm running into is that when connected, the split-...
640KB's user avatar
  • 101
1 vote
1 answer
45 views

Pinging packets greater than 1500 between two proper configured machines on proper configured networks, always possible?

Given the following 3 subnet topology, I will give names to them to simplify it, I am using planets, I see it as a perfect geographic enumeration. Sites Office on Earth 172.1.x FiOS, default MTU ...
Sam Washington's user avatar
1 vote
1 answer
42 views

IPSec Site to Site VPN Connected but Subnets not Routing [closed]

Re: Creating a site to site vpn from ubuntu 22 + strongswan to cisco meraki Issue: I've established a vpn tunnel but routing between clients on the network is not working. meraki config: Non-Meraki ...
Matt Campbell's user avatar
0 votes
1 answer
47 views

How to access SVI from the other side of a tunnel? [closed]

With two vlans separated by an IPSec tunnel, I'm having issues reaching an SVI on the far end. Hosts on either end can ping each other without issue, but the SVI's do not respond from the far end, ...
chrismec's user avatar
1 vote
0 answers
38 views

Issue with Cisco ASA IPSec VPN clients can't access DMZ network

I have one ASA that is configured for IPSec VPN Cisco client. The VPN allow access to inside network, but trying to get it to my DMZ is a problem. My VPN address pool is defined as 124.140.1.x /24. My ...
Steve's user avatar
  • 11
0 votes
1 answer
72 views

IKEv2 Traffic Selector Narrowing Nuance

For IKEv2, when the responder receives traffic selector payloads from the initiator in the IKE_AUTH message, it must narrow the traffic selectors to be acceptable by policy. I am curious about how the ...
WakkaTrout's user avatar
1 vote
1 answer
118 views

Juniper MX with MS-MIC and ipsec performance

I've set up the gre over ipsec tunnel between SRX650 and MX5 (MS-MIC onboard). While SRX is able to serve ipsec tunnels traffic at about 100-200 Mbit/sec to other SRXes, I can get only about 1.5 Mbit/...
drookie's user avatar
  • 243
0 votes
0 answers
93 views

IPsec no working properly

I want to set an IPsec between two routers similar to the one in this lab, however the client on router EAST is NATted with the public IP 98.76.65.42 on the local side EAST(config)# access-list 110 ...
nirvana's user avatar
0 votes
1 answer
66 views

IPSec over L2GRE scenario

I wanted to know if this is a valid scenario and if it is possible to implement. There is a remote site A. and a Data center site B. Both A and B have a edge router which runs an IPSec tunnel. An ...
RootPhoenix's user avatar
0 votes
1 answer
174 views

How to configure IDr on Cisco ASA for AWS IPsec tunnels

I am currently facing an issue while attempting to establish IPsec tunnels between AWS and a Cisco ASA firewall. The AWS tunnel logs indicate that the Identity Resolution checks are failing, ...
Ajit Trivedi's user avatar
0 votes
1 answer
242 views

DH groups support for isakmp policy

When configuring a site-to-site VPN tunnel between the ASA and Cisco router, I have queries around the ISAKMP policy. As per Cisco documentation for ASA, the crypto isakmp policy groups available are ...
Blake's user avatar
  • 57
0 votes
2 answers
266 views

IPsec PFS Confusion

I'm reading conflicting things about how PFS works in IPsec. Some sources say it's simply a renegotiation of the Phase 1 IKE/ISAKMP SA that ignores the original IKE/ISAKMP SA lifetime value and that ...
Ceejus's user avatar
  • 1
1 vote
1 answer
119 views

VPN doesn't work

I'm trying to configure VPN between 2 routers: R1: public IP is 200.0.0.6/30 on S0/0/1, private IP are 10.0.0.0/8 and 20.0.0.0/8 R3: public IP is 210.10.0.6/30 on S0/0/0, private IP is 192.168.3.0/24 ...
Penguin's user avatar
  • 27
0 votes
0 answers
99 views

Cisco IPSec VTI model not working as expected

I'm trying to new IPSec connection recommended by Cisco, here Now i reserved a DevNet CML Sandbox and using the IOS-XE routers in there, which is Dist-RT01 and Dist-RT02. Since CML sandbox using mgmt ...
frknl's user avatar
  • 1
1 vote
0 answers
27 views

Complicated bridge between 2 servers [closed]

I have 3 servers: comp_a, comp_b, comp_c comp_a ([eth0 «10.15.14.55»]) 10.0.0.0/8 <———> comp_b ([eth0 «10.15.27.61», eth1 «10.15.26.61»] [eth1 «10.15.26.61» ]) <——VPN IPS (left = 10.15.0.0/16 ...
Slashere's user avatar
0 votes
2 answers
973 views

How to solve high ping "spikes" to pfSense when ipSec connections are active?

Background information: We have latency/freeze problems with our pfSense. To be able to answer the question i will first give some general background information: We run pfSense V2.6.0 on following ...
CodeNinja's user avatar
  • 219
0 votes
1 answer
721 views

Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

My end of the tunnel is on an ASAv in AWS. (version 9.14) show crypto isakmp sa 4 IKE Peer: 212.239.x.y Type : L2L Role : responder Rekey : no State : ...
Chris Holt's user avatar
1 vote
2 answers
2k views

Is it possible to implement IPSEC over MPLS?

On a high level, I understand that the data-traffic(original ip packet) is encrypted and encapsulated in ESP header (imagine a IPSEC in tunnel mode). Generally, this IPSEC tunnel is triggered by ...
Hemanth's user avatar
  • 1,124
0 votes
0 answers
133 views

IP pkt len in ESP transport mode? How to validate ESP pad length?

What will be the value of packet-length/Total length field in the IP headers for ESP packets in transport mode? For instance, in tunnel mode below are the values:- Outer-IP header's Packet length = ...
Hemanth's user avatar
  • 1,124
0 votes
2 answers
595 views

IPSEC ESP tunnel mode - Are the ip addresses in outer IP HDR same as addresses in inner encrypted IP HDR?

Am trying to understand how IPSEC in tunnel mode achieves the VPN functionality. I understand that the IP header and payload along with TCP/UDP headers are encrypted. But, if the src and dst addresses ...
Hemanth's user avatar
  • 1,124
2 votes
2 answers
83 views

Why does IKEv2 forbid dynamic address updates for hosts behind NAT?

In RFC7296, Section 2.23 it is written: There are cases where a NAT box decides to remove mappings that are still alive (for example, the keepalive interval is too long, or the NAT box is rebooted). ....
Kentzo's user avatar
  • 123
0 votes
1 answer
113 views

Switching Internet connection on Cisco ASA

I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to ...
Ruslan's user avatar
  • 155
2 votes
2 answers
2k views

FortiGate: IPSec peer-to-peer and two remote peers

I have a FortiGate firewall in the main office and some branches with Cisco ASA. An IPsec tunnel runs between the main office and each branch. Some branches have two ISP - main and reserve. For ...
Ruslan's user avatar
  • 155
1 vote
0 answers
235 views

Diffie-Hellman with PSK/PKI in the context of IKEv1

It seems I fail to understand few things about DH's functionality in the context of IKEv1. A little bit of context first: During IKE Main Phase, with the 3rd and 4th messages, the peers each exchange ...
Cosmin Ionut Grosu's user avatar
1 vote
1 answer
88 views

OSPFv3 Authentication IPSEC SPI/Logging issues - Can you filter out logs?

I'm running into a problem with our Cisco ASR-1002HX and ASR-1006X. I have a mix of Juniper and Cisco routers all configured exclusively with IPv6. All of our routers are in the same ospfv3 area 0. We ...
Ben's user avatar
  • 157
1 vote
1 answer
3k views

IPSec IKEv2 on pfSense: "parsed INFORMATIONAL request 2 [ N(AUTH_FAILED) ]"

I am trying to setup an IPSec IKEv2 VPN Network on a pfSense. The pfsense is situated directly behind the modem. I connect to it by a static IP address. There is no double NAT. I followed this ...
neNutzer89's user avatar
1 vote
2 answers
2k views

Why does IPsec not support Multicast/Broadcast?

Many sources site GRE as supporting broadcast/multicast and IPsec does not. Both GRE and IPsec are merely tunneling protocols. Therefore there is nothing inherent about tunneling protocols which ...
jester's user avatar
  • 127
2 votes
2 answers
799 views

Site-to-Site VPN with Sophos XG using tunnel interface

So I have configured a Sophos XG site-to-site vpn according to this document: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/...
FloatingPointOperation's user avatar
6 votes
4 answers
4k views

What's the advantage of IPSec over TLS/DTLS? [closed]

What's the benefit of IPSec over TLS and DTLS ? If someone's goal is to assure authentication, integrity and confidentiality, can't he/she simply encrypt the content with the two last protocols (on ...
Alan Evangelista's user avatar
0 votes
2 answers
173 views

Cisco ASA access-lists and net config

Here are my config to this network. I found the ASA doesn’t ping through each other. Also, when I type show crypto isakmp SA and IPSec Sa, it doesn’t show anything at all. Could you guys find what’s ...
David Huang's user avatar
0 votes
1 answer
191 views

VPN/IPsec router support in Packet Tracer

I would like to know, if a router doesn't support VPN (meaning it can't be used as a VPN server) can it still route an IPsec packet? And which router I should use as a server for IPSec (AH tunnel mode)...
Yasmine's user avatar
1 vote
0 answers
978 views

IKEv2 between Cisco router and Google cloud VPN

Hey I'm trying to create a tunnel between cisco router and google cloud vpn (client site) but the connection is stuck on stage 2 (UP-IDLE), need help where the problem may lie. Some debug that I get ...
Stimpee Eta's user avatar
1 vote
0 answers
318 views

UNIFI USG GATEWAY IPSEC OVER L2TP VPN [closed]

At my office I have a Unifi USG Gateway that currently has 3 IPSEC VPN Tunnels (Lan-To-Lan VPN) configured. I also have a L2TP Remote VPN Network configured so that when I'm outside of my office I can ...
Carlos Sosa's user avatar
1 vote
0 answers
2k views

Cisco ASA drops packets which match crypto acl. VPN not bring UP [closed]

I've some problem with IPSEC tunnel between Cisco ASA and Fortigate. For some reason, packet 10.12.4.0/12 to 192.168.0.0/16 drops by ASA, despite the fact 192.168.0.0/16 is present in crypto ACL. Can ...
Vladimir Fomin's user avatar
1 vote
0 answers
7k views

Cisco site-to-site VPN tunnel Failed to find a matching policy [closed]

I have PaloAlto (PA) and Cisco ASA 5585-X located on two different sites, trying to configure IPsec VPN tunnel. [PA]-----------(internet)-----------[Cisco ASA] If i ping from Cisco ASA side lan to PA ...
Satish's user avatar
  • 4,379
0 votes
0 answers
111 views

static IP multicast routing with IPSEC

for a specific application, I need to route a multicast flow with IPSEC (we use a CISCO ASA 5508 firewall), I am not a network expert then I will try to explain as best as I can our issue I don't need ...
Gcomel's user avatar
  • 1
0 votes
0 answers
87 views

Does multicast over tunnels (e.g., GRE) require IGMP/MLD?

When subscribing to a multicast group on a tunnel device such as a GRE tunnel, are you supposed to participate in IGMP/MLD over that tunnel in order to announce your membership in the multicast group? ...
joshlf's user avatar
  • 327
4 votes
2 answers
1k views

MTU/MSS Oddness?

We have an IKEv2 IPSec tunnel between two Sophos XG Firewall appliances in a corporate system for a remote site. We don't have any specialized MSS or MTU settings other than what the IPSec tunnel ...
Thomas Ward's user avatar
0 votes
1 answer
313 views

Cisco IPsec VPN tunnel problem

I have a problem with VPN configuration. This is the topology I created: First updated licenses to make the VPN available: license boot module c1900 technology-package securityk9 IPsec Router ...
perelt's user avatar
  • 3
0 votes
0 answers
199 views

Editing a crypto map with multiple entries

We're attempting to bring up an IPSEC tunnel with a Vendor. An engineer created the crypto map and wasnt able to establish a connection. I edited the entry to change the diffie-hillman group and the ...
GH312's user avatar
  • 11
0 votes
2 answers
340 views

Why cant't IPSec's Transport Mode ESP be used in NAT64 although ESP doesn't sign the new IP header?

In RFC6146 stated: Any protocols that protect IP header are incompatible with NAT64. This implies that end-to-end IPsec verification will fail when the Authentication Header (AH) is used (both ...
maximillian1's user avatar
1 vote
1 answer
113 views

IKEv2 notification payload regarding IKE SA

I am puzzled about two paragraphs regarding a notification payload in section 3.10 of RFC7296. There you can find the following: o Protocol ID (1 octet) - If this notification concerns an existing ...
Mathias Weidner's user avatar
2 votes
1 answer
1k views

Is an IPSec connection between 2 devices behind NAT possible?

We have tens of IPSec connections between our office and customer site's. We use an extra router in the customer network (so behind NAT) to initiate the connection to our office where a PFSense router ...
CodeNinja's user avatar
  • 219
0 votes
2 answers
196 views

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

This question is about encryption in data communications, defined broadly to include: Line scrambling at layer 1 MACsec at layer 2 IPsec at layer 3 TLS at layer 4 etc. All of these encryption ...
Bruno Rijsman's user avatar
0 votes
1 answer
62 views

Access IPSec site from another IPSec site

Our company delivers, installs and maintains custom build hardware at customer sites. In all cases the delivered setup contains at least 1 server and 2 network devices. To keep the control over the ...
CodeNinja's user avatar
  • 219
0 votes
2 answers
109 views

Setup IPSEC in Hub/Spoke fashion

I'm trying to setup IPSEC tunnels in a hub/spoke type fashion. I've emulated this in GNS3 by creating three sites. Each site uses an IOSv router as it's WAN router. I'm using site 2 as the hub and ...
dutsnekcirf's user avatar
2 votes
1 answer
424 views

Confusion about Route based IPSEC site-site vpn and policy based IPSEC site-site VPN

I am confused about the major difference between a policy-based VPN and routed-based site-site Vpn
RosyRoy's user avatar
  • 21
1 vote
1 answer
460 views

Juniper QFX Site to Site VPN

Im trying to setup a site to site vpn between two Juniper QFX5110's. Each end of the link is on the same subnet (so directly connected switches over dark fibre). I have configured each physical ...
Dylan's user avatar
  • 25
0 votes
2 answers
112 views

IPSEC between two offices with SAME local networks. How should I do nat? [duplicate]

I have two spokes with same local networks and want to do IPSEC between them. When I try to ping 172.17.214.111 from 192.168.5.0 (from right side to left side) I see packet on Cisco router and I see ...
Vladimir Fomin's user avatar

1
2 3 4 5 6