Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

1
vote
0answers
33 views

Why do the tunnel protocol on these two router show different values

Two routers R1 and R2 have a tunnel built between them in the 103.103.103.0/24 network. The end point of the tunnel are 75.75.75.2(on R1) and 76.76.76.2(on R2). Can anyone explain why does the Tunnel ...
1
vote
1answer
23 views

Can a VPN tunnel between routers be built with different tunnel protocol on both ends?

I have two routers and the tunnel between them is up and working well. Router1 has GRE/IP as the protocol on its tunnel interface, and as for Router2 the tunnel interface is working with IPSEC/IP. Can ...
3
votes
2answers
61 views

Azure VPN vs. Cisco ASA

I have a Cisco 5516-x with v9.7(1)21 on my end and I am trying to create a working VPN to Azure. It looks to me like phase1 goes well but phase2 fails due to policy mismatch. Any suggestions for how ...
2
votes
1answer
37 views

Why aren't we encrypting data on Network level instead of transport level when using e.g. HTTP [closed]

Why we are bothering to encrypt our data on a transport level, instead of just doing that on a network level with e.g. IPSec and get rid of the need to to that in upper layers. For example instead of ...
0
votes
1answer
38 views

Can I use the same IPsec tunnel for two VRF?

I have two routers linked by two logical links in two different VRF. I should move one router to another site and use Internet to keep the same connectivity. Since I use private IP addresses in my VRF,...
1
vote
2answers
31 views

AWS site-to-site VPN and multiple account VPC connections

I've configured a site-to-site VPN from our firewall (watchguard) to AWS. Now, how can I connect Account A with Account B? I've already an OpenVPN server in account A to which account B connects (...
3
votes
2answers
108 views

IKE phase 1 and phase 2

Was going through the IKE phase 1 and phase 2. I have some questions regarding the same which is bothering me with respect to main mode and quick mode.Please correct me if i go wrong somewhere. Phase ...
4
votes
1answer
96 views

Use cases for GRE over IPSEC

I'm trying to understand use cases for GRE over IPSEC. In the diagram below, each site uses GRE to encapsulate multicasts associated with OSPF. (There is still a requirement to configure SAs between ...
1
vote
0answers
60 views

AWS tunnel TCP retransmissions and DUP ACKs

I have a IPsec tunnel from my firewall towards AWS, the tunnel is up in both phases. If I run traffic sniffer in the firewall, I can see interesting traffic going through, but there are MANY TCP ...
1
vote
1answer
38 views

Shared secret key for Diffie-Hellman key exchange

From what i have learnt,in Asymmetric key there is public key and a private key. For instance: Step 1: Alice and Bob get public numbers P = 23, G = 9 Step 2: Alice selected a private key a = 4 and ...
2
votes
1answer
47 views

IPSec Tunnel not coming up: Issue with ACL?

I'm trying to bring up a IPsec tunnel between router and a bridge. I can see the Ipsec tunnel configurations are up and running but I think I have made a mistake in the ACL and hence the encr and decr ...
2
votes
1answer
116 views

how security association (SA) is established?

I'm a newbie in networking, still struggling to understand some concepts. I was reading a text describes security association (SA) in VPN. Whenever router R1 needs to construct an IPsec datagram for ...
1
vote
1answer
65 views

Pass traffic from remote access to site to site tunnel

I have situation where remote access ipsec client have to connect to ASA firewall to send and receive traffic using site to site tunnel on the same ASA, in the logs I am seeing packets dropped as it ...
1
vote
1answer
56 views

Outbound NAT for single host behind an ASA located over an IPSEC tunnel [closed]

I have these two nets connected over the public internet with ASA 5510s. 192.168.0.0 < -- ASA1 ---> Internet <--- ASA2 --> 192.168.5.0 Each net does either a simple dynamic or static nat ...
2
votes
1answer
190 views

Junos IPSEC Tunnel to Azure & TCP-MSS

I am configuring a Juniper SRX 300 Series to establish an IPSEC tunnel to Azure. The Azure Vnet range is 192.168.10.0/23 The local range is 10.49.236.0/24. The configuration: (relevant bits with ...
2
votes
1answer
266 views

L2TP IPSec Remote VPN - Many users connecting remotely from same access

Can someone explain to me, why isn't possible to connect 2 or more clients to a VPN server when the users are behind the same public IP (NAT/PAT). What I mean is: if there is already a user connected ...
1
vote
1answer
244 views

Result of running `restart ipsec-key-management`

I have Juniper SRX 1400 which is used mainly for IPSEC tunnels. And now I facing a bug in firmware with ID PR1085657 (IKE doesn't come up when the SRX is the initiator). Possible solutions to this is ...
2
votes
1answer
420 views

Site-to-site IPSEC for multiple peers with dynamic IP on Juniper SRX

Looking for possible solution. I have Juniper SRX 1400 (12.1X47-D20.7) with static WAN IP in data-center and multiple sites with dynamic WAN IP addresses. I need to build with them site-to-site VPN's....
2
votes
0answers
234 views

RSA key not working with trustpoint used for IPSec

I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup. Importing is ...
2
votes
1answer
97 views

Latency-sensitive channel bonding

One of our satellite offices is connected by a Satellite connection with no other high bandwidth option. Reliability is good and bandwidth is acceptable (50/10 MB/s), but latency is making, ssh, VPN ...
2
votes
2answers
579 views

GRE-IPsec Tunnel between Cisco Router and a Linux Router

I am trying to create a GRE/IPsec tunnel between Cisco router and a Linux Router. The tunnel is UP and active, but when I do a "show crypto session" on the Cisco router the Active SA's keep on ...
4
votes
1answer
2k views

IPSec failure with `IKE message failed its sanity check or is malformed`

I've been battling with my IPSec configuration for some days (with foolish deadline looming) and would like to ask for help with it failing its initial connection. It's designed as client-to-router ...
2
votes
0answers
29 views

encryption gateway vs domain and source ip issues [closed]

(This is the same setup as a previous question.) My VPN connection was no longer working (for ~4h), so I called the remote end's tech support. While we were talking, the link mysteriously started ...
0
votes
1answer
225 views

Configuring IPsec VPN and TTL

I have two sites, each using their own firewall. Once a Cisco Meraki, another a Cisco ASA. The two sites use IPsec to establish a VPN tunnel. The Question: If each of the two sites have different ...
0
votes
2answers
64 views

IPSec - NAT-T inner/outer IP of the gateway?

I was configuring an IPSec VPN and somehow I can't figure out what the inner/outer IP of my gateway would be. Have a look at this image : Imagine I have my site-to-site VPN, with my gateway having ...
0
votes
0answers
20 views

IPsec VPN Setup

Below is the flow 10.1.0.0>Data Center Firewall>Internet Router> ----Internet---- So basically i am setting up new ipsec tunnel between two Cisco internet routers for branch office users to access ...
-1
votes
3answers
283 views

Connecting to subnets with IPSec VPN, how to route?

I set up a site-to-site VPN between two TP-Link routers, following the instructions here: https://www.tp-link.com/ae/faq-380.html . The VPN is based on IPSec. Now both routers say that the IPSec ...
1
vote
1answer
227 views

Cisco VRF aware dynamic VTI based IPSEC VPN

im struggeling on a Cisco IPSEC Konfiguration. My aim is to terminate spoke sites behind CGN gateways into a MPLS L3VPN Network via IPSEC tunnels. The router at hub site is a ASR1k running IOS XE 3....
1
vote
1answer
325 views

ASA VPN Tunnel NAT Issues

I've been trying to jump through two tunnel. A Customer has a cloud solution which we need access to. Since we already have a vpn site2site tunnel to the customer we can already access his LAN. What ...
-1
votes
0answers
116 views

IPsec with public IP for Remote Gateway and Remote Subnet (address)

I have a customer with a public IP for the Remote Gateway in Phase 1 (8.x.y.a) and a public IP address as Remote Subnet in Phase 2 (8.x.y.b). Customer setup uses a Cisco ASR. On my site I use pfSense ...
4
votes
1answer
73 views

Confused on perfect forward secrecy, someone kindly help me

i just read following article In IPsec VPN, how is the pre-shared key encrypted? got knowledge about phase 1 also basic line over PFS: for every new negotiation of Phase 2 SA the 2 gateways must ...
1
vote
1answer
87 views

IPv6 VPNs source address selection

Say I have the following IPv6 prefix assigned to me by my ISP : 2a01:1000:1000::/48 with 2a01:1000:1000::1/48 assigned to my VPN server. I set up a VPN with a /64 from that block to assign to my ...
2
votes
1answer
706 views

SonicWall is dropping encrypted packets with error “sonicwall ipsec vpn decryption failed selector check error”

I have implemented a Site-to-Site IPsec tunnel between a Juniper SSG firewall and a SonicWall. However, any traffic that I send over the tunnel gets dropped on the SonicWall with an error saying ...
3
votes
3answers
254 views

Layer 3 tunnel with Dynamic IP address

I want to ask whether it is possible to configure Layer 3 Tunnel with the two end points/interfaces have dynamic IP address? If the interface IP change, the tunnel will have to be re-negotiated, is ...
1
vote
2answers
2k views

Cisco ASA MTU vs TCP MSS

I am trying to set jumbo MTU for Cisco ASA 5585 and I did following: asa1/pri/act(config)# mtu inside 9000 INFO: Jumbo frames should be enabled to receive packets more than 1500 MTU Use '...
3
votes
1answer
147 views

ASA as a local DNS resolver

I have an site to site VPN access configured by ASAs. My remote site needs to connect to the domain through the tunnel which will required DNS located on the main site. I would like to use DNS server ...
3
votes
1answer
2k views

IPsec Tunnel is showing decrypt packets counter but 0 encryption packets: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

I have just configured the IPSEC tunnel between my router and the Access point.I could see that the Tunnel has came up and Active in both sides. However,When I checked the "Show cyrpto ipsec sa" ,I ...
1
vote
1answer
233 views

PBR not working as expected

EDITED: ADDED FULL ROUTER CONFIG I have a cisco 2921. It uses EIGRP to learn its routing table and has no static default routes set up. I would like to keep it that way. The default route (learned ...
1
vote
1answer
635 views

Cisco ASA DH group and Lifetime of Phase 2

Not very good with ASAs so please have that in mind. I need to replace an ASA but can't seem to get some info on Phase 1 and Phase 2. I can get everything from Phase 1 except the DH group (got PFS ...
1
vote
2answers
337 views

SIte-to-Site VPN between ASAv8 and ASAv9: NAT issue

I'm setting up a site-to-site via ASDM. Initially I configured both devices correctly, matching policies, crypto, etc and set both inside networks as "NAT exempt". Problem is, when I apply changes on ...
1
vote
1answer
369 views

Cisco 5506-x dynamic site to site tunnel doesn't works

I am followed ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example step by step, currently I am using IP address 10.0.0.1 for the static peer and 10.0.0.2 for the dynamic peer, but seems ...
1
vote
2answers
212 views

Cisco IPSEC Tunnel with hidden local networks

I've got an ipsec tunnel that's up and working with ATT. They require that the phase 2 IP's not be local LAN's, but public IP's. So, my phase 1 is X.X.X.132, and my Phase 2 is on the same subnet as X....
1
vote
1answer
270 views

SonicWall Site-to-site VPN with WAN IP endpoint

I'm not a real network engineer (just something I must dabble in from time to time), so hopefully I will provide enough detail and use the right terminology here. We have a site-to-site VPN ...
4
votes
1answer
1k views

IPSec site-to-site with/without NAT

I am connecting my office to a client's network via IPSec. The need is for me to connect directly to internal IPs on their network; there is no need for them to connect to any services on my internal ...
2
votes
1answer
856 views

How to keep an ASA tunnel up for lifetime?

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening: When I send a packet or generate interesting traffic, it brings up the tunnel and everything ...
1
vote
1answer
1k views

IPSec IKEv2 connection failure due to RSA authentication issue

I'm trying to get an IPSec/IKEv2 setup working, which was implement following this I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
1
vote
1answer
80 views

Secure communication between multiple sites over Internet

Does anyone know what would be the best practice to securely connect 2 or more branches with HQ over the Internet, and to allow communication between all of them (so anyone can contact anyone) if I ...
0
votes
0answers
675 views

IPsec tunnel getting drop and reconnect itself frequently

We have IPsec tunnel which is working but somehow getting drop and reconnect itself and that causing disturbance in application, i am unable to find root cause. I have check isakmp and crypto map ...
1
vote
2answers
4k views

How are VPN Clients given IP addresses when they connect to VPN Routers such as VyOS? (How do Virtual IP Address Pools fit in?)

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network when they connect to the StrongSWAN or OpenVPN VPN Server that's embedded in VyOS ...
2
votes
1answer
2k views

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

We have following scenario, my side we have Cisco ASA and we have IPsec tunnel to Customer US-Datacenter and i can ping 172.16.0.0 subnet from my ASA (local LAN 10.0.0.0/8) but now i want to ping EU-...