Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

0
votes
0answers
13 views

what is the procedure of configuring private NAT on site to site vpn network? [on hold]

There is site to site ipsec vpn and both site having their separate firewall and Network IP is 192.168.10.1/24 . what is the procedure of configuring private NAT ? and explain in details when we ping ...
3
votes
2answers
70 views

IKE phase 1 and phase 2

Was going through the IKE phase 1 and phase 2. I have some questions regarding the same which is bothering me with respect to main mode and quick mode.Please correct me if i go wrong somewhere. Phase ...
4
votes
1answer
61 views

Use cases for GRE over IPSEC

I'm trying to understand use cases for GRE over IPSEC. In the diagram below, each site uses GRE to encapsulate multicasts associated with OSPF. (There is still a requirement to configure SAs between ...
0
votes
0answers
26 views

USG Remote to USG Pro Home Base: Cannot route Internet-destined traffic over IPSec tunnel

We have a situation where we have two sites - a HOME office and a REMOTE satellite office. Due to the fact we need multiple IPSec VPNs at HOME and each REMOTE, we can't use the automated VTI approach,...
1
vote
0answers
25 views

AWS tunnel TCP retransmissions and DUP ACKs

I have a IPsec tunnel from my firewall towards AWS, the tunnel is up in both phases. If I run traffic sniffer in the firewall, I can see interesting traffic going through, but there are MANY TCP ...
1
vote
1answer
33 views

Shared secret key for Diffie-Hellman key exchange

From what i have learnt,in Asymmetric key there is public key and a private key. For instance: Step 1: Alice and Bob get public numbers P = 23, G = 9 Step 2: Alice selected a private key a = 4 and ...
2
votes
1answer
38 views

IPSec Tunnel not coming up: Issue with ACL?

I'm trying to bring up a IPsec tunnel between router and a bridge. I can see the Ipsec tunnel configurations are up and running but I think I have made a mistake in the ACL and hence the encr and decr ...
1
vote
1answer
92 views

how security association (SA) is established?

I'm a newbie in networking, still struggling to understand some concepts. I was reading a text describes security association (SA) in VPN. Whenever router R1 needs to construct an IPsec datagram for ...
1
vote
1answer
56 views

Pass traffic from remote access to site to site tunnel

I have situation where remote access ipsec client have to connect to ASA firewall to send and receive traffic using site to site tunnel on the same ASA, in the logs I am seeing packets dropped as it ...
1
vote
1answer
42 views

Outbound NAT for single host behind an ASA located over an IPSEC tunnel [closed]

I have these two nets connected over the public internet with ASA 5510s. 192.168.0.0 < -- ASA1 ---> Internet <--- ASA2 --> 192.168.5.0 Each net does either a simple dynamic or static nat ...
1
vote
1answer
120 views

Junos IPSEC Tunnel to Azure & TCP-MSS

I am configuring a Juniper SRX 300 Series to establish an IPSEC tunnel to Azure. The Azure Vnet range is 192.168.10.0/23 The local range is 10.49.236.0/24. The configuration: (relevant bits with ...
1
vote
1answer
126 views

L2TP IPSec Remote VPN - Many users connecting remotely from same access

Can someone explain to me, why isn't possible to connect 2 or more clients to a VPN server when the users are behind the same public IP (NAT/PAT). What I mean is: if there is already a user connected ...
1
vote
1answer
133 views

Result of running `restart ipsec-key-management`

I have Juniper SRX 1400 which is used mainly for IPSEC tunnels. And now I facing a bug in firmware with ID PR1085657 (IKE doesn't come up when the SRX is the initiator). Possible solutions to this is ...
2
votes
1answer
311 views

Site-to-site IPSEC for multiple peers with dynamic IP on Juniper SRX

Looking for possible solution. I have Juniper SRX 1400 (12.1X47-D20.7) with static WAN IP in data-center and multiple sites with dynamic WAN IP addresses. I need to build with them site-to-site VPN's....
2
votes
0answers
168 views

RSA key not working with trustpoint used for IPSec

I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup. Importing is ...
1
vote
1answer
79 views

Latency-sensitive channel bonding

One of our satellite offices is connected by a Satellite connection with no other high bandwidth option. Reliability is good and bandwidth is acceptable (50/10 MB/s), but latency is making, ssh, VPN ...
2
votes
2answers
408 views

GRE-IPsec Tunnel between Cisco Router and a Linux Router

I am trying to create a GRE/IPsec tunnel between Cisco router and a Linux Router. The tunnel is UP and active, but when I do a "show crypto session" on the Cisco router the Active SA's keep on ...
4
votes
1answer
1k views

IPSec failure with `IKE message failed its sanity check or is malformed`

I've been battling with my IPSec configuration for some days (with foolish deadline looming) and would like to ask for help with it failing its initial connection. It's designed as client-to-router ...
2
votes
0answers
27 views

encryption gateway vs domain and source ip issues

(This is the same setup as a previous question.) My VPN connection was no longer working (for ~4h), so I called the remote end's tech support. While we were talking, the link mysteriously started ...
0
votes
1answer
145 views

Configuring IPsec VPN and TTL

I have two sites, each using their own firewall. Once a Cisco Meraki, another a Cisco ASA. The two sites use IPsec to establish a VPN tunnel. The Question: If each of the two sites have different ...
0
votes
2answers
51 views

IPSec - NAT-T inner/outer IP of the gateway?

I was configuring an IPSec VPN and somehow I can't figure out what the inner/outer IP of my gateway would be. Have a look at this image : Imagine I have my site-to-site VPN, with my gateway having ...
0
votes
0answers
19 views

IPsec VPN Setup

Below is the flow 10.1.0.0>Data Center Firewall>Internet Router> ----Internet---- So basically i am setting up new ipsec tunnel between two Cisco internet routers for branch office users to access ...
-1
votes
3answers
205 views

Connecting to subnets with IPSec VPN, how to route?

I set up a site-to-site VPN between two TP-Link routers, following the instructions here: https://www.tp-link.com/ae/faq-380.html . The VPN is based on IPSec. Now both routers say that the IPSec ...
0
votes
1answer
182 views

Cisco VRF aware dynamic VTI based IPSEC VPN

im struggeling on a Cisco IPSEC Konfiguration. My aim is to terminate spoke sites behind CGN gateways into a MPLS L3VPN Network via IPSEC tunnels. The router at hub site is a ASR1k running IOS XE 3....
0
votes
1answer
228 views

ASA VPN Tunnel NAT Issues

I've been trying to jump through two tunnel. A Customer has a cloud solution which we need access to. Since we already have a vpn site2site tunnel to the customer we can already access his LAN. What ...
0
votes
0answers
84 views

IPsec with public IP for Remote Gateway and Remote Subnet (address)

I have a customer with a public IP for the Remote Gateway in Phase 1 (8.x.y.a) and a public IP address as Remote Subnet in Phase 2 (8.x.y.b). Customer setup uses a Cisco ASR. On my site I use pfSense ...
4
votes
1answer
67 views

Confused on perfect forward secrecy, someone kindly help me

i just read following article In IPsec VPN, how is the pre-shared key encrypted? got knowledge about phase 1 also basic line over PFS: for every new negotiation of Phase 2 SA the 2 gateways must ...
1
vote
1answer
67 views

IPv6 VPNs source address selection

Say I have the following IPv6 prefix assigned to me by my ISP : 2a01:1000:1000::/48 with 2a01:1000:1000::1/48 assigned to my VPN server. I set up a VPN with a /64 from that block to assign to my ...
1
vote
1answer
611 views

SonicWall is dropping encrypted packets with error “sonicwall ipsec vpn decryption failed selector check error”

I have implemented a Site-to-Site IPsec tunnel between a Juniper SSG firewall and a SonicWall. However, any traffic that I send over the tunnel gets dropped on the SonicWall with an error saying ...
3
votes
3answers
201 views

Layer 3 tunnel with Dynamic IP address

I want to ask whether it is possible to configure Layer 3 Tunnel with the two end points/interfaces have dynamic IP address? If the interface IP change, the tunnel will have to be re-negotiated, is ...
1
vote
2answers
1k views

Cisco ASA MTU vs TCP MSS

I am trying to set jumbo MTU for Cisco ASA 5585 and I did following: asa1/pri/act(config)# mtu inside 9000 INFO: Jumbo frames should be enabled to receive packets more than 1500 MTU Use '...
3
votes
1answer
124 views

ASA as a local DNS resolver

I have an site to site VPN access configured by ASAs. My remote site needs to connect to the domain through the tunnel which will required DNS located on the main site. I would like to use DNS server ...
3
votes
1answer
2k views

IPsec Tunnel is showing decrypt packets counter but 0 encryption packets: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

I have just configured the IPSEC tunnel between my router and the Access point.I could see that the Tunnel has came up and Active in both sides. However,When I checked the "Show cyrpto ipsec sa" ,I ...
1
vote
1answer
212 views

PBR not working as expected

EDITED: ADDED FULL ROUTER CONFIG I have a cisco 2921. It uses EIGRP to learn its routing table and has no static default routes set up. I would like to keep it that way. The default route (learned ...
1
vote
1answer
555 views

Cisco ASA DH group and Lifetime of Phase 2

Not very good with ASAs so please have that in mind. I need to replace an ASA but can't seem to get some info on Phase 1 and Phase 2. I can get everything from Phase 1 except the DH group (got PFS ...
1
vote
2answers
300 views

SIte-to-Site VPN between ASAv8 and ASAv9: NAT issue

I'm setting up a site-to-site via ASDM. Initially I configured both devices correctly, matching policies, crypto, etc and set both inside networks as "NAT exempt". Problem is, when I apply changes on ...
1
vote
1answer
283 views

Cisco 5506-x dynamic site to site tunnel doesn't works

I am followed ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example step by step, currently I am using IP address 10.0.0.1 for the static peer and 10.0.0.2 for the dynamic peer, but seems ...
1
vote
2answers
144 views

Cisco IPSEC Tunnel with hidden local networks

I've got an ipsec tunnel that's up and working with ATT. They require that the phase 2 IP's not be local LAN's, but public IP's. So, my phase 1 is X.X.X.132, and my Phase 2 is on the same subnet as X....
0
votes
1answer
220 views

SonicWall Site-to-site VPN with WAN IP endpoint

I'm not a real network engineer (just something I must dabble in from time to time), so hopefully I will provide enough detail and use the right terminology here. We have a site-to-site VPN ...
4
votes
1answer
1k views

IPSec site-to-site with/without NAT

I am connecting my office to a client's network via IPSec. The need is for me to connect directly to internal IPs on their network; there is no need for them to connect to any services on my internal ...
2
votes
1answer
723 views

How to keep an ASA tunnel up for lifetime?

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening: When I send a packet or generate interesting traffic, it brings up the tunnel and everything ...
1
vote
1answer
1k views

IPSec IKEv2 connection failure due to RSA authentication issue

I'm trying to get an IPSec/IKEv2 setup working, which was implement following this I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
1
vote
1answer
76 views

Secure communication between multiple sites over Internet

Does anyone know what would be the best practice to securely connect 2 or more branches with HQ over the Internet, and to allow communication between all of them (so anyone can contact anyone) if I ...
0
votes
0answers
576 views

IPsec tunnel getting drop and reconnect itself frequently

We have IPsec tunnel which is working but somehow getting drop and reconnect itself and that causing disturbance in application, i am unable to find root cause. I have check isakmp and crypto map ...
1
vote
2answers
3k views

How are VPN Clients given IP addresses when they connect to VPN Routers such as VyOS? (How do Virtual IP Address Pools fit in?)

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network when they connect to the StrongSWAN or OpenVPN VPN Server that's embedded in VyOS ...
2
votes
1answer
1k views

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

We have following scenario, my side we have Cisco ASA and we have IPsec tunnel to Customer US-Datacenter and i can ping 172.16.0.0 subnet from my ASA (local LAN 10.0.0.0/8) but now i want to ping EU-...
1
vote
1answer
508 views

IPsec vpn missing crypto keyring

We have VPN tunnel with our customer and they sent their side VPN config and i am trying to put that config in my Cisco ASA 5585 (9.x) version and it has missing crypto keyring command Customer ...
2
votes
1answer
629 views

How to configure site to site VPN between Cisco ASA and Cisco router? [closed]

I have CISCO ASA on one site and CISCO ROUTER on other side, both have outside interface facing public IP and doing NAT for internal VLAN's. How to connect different VLAN's on one site to VLAN's on ...
0
votes
0answers
1k views

IPsec VPN between Cisco ASA 5505 8.2(5) and MikroTik 6.40.5

I'm trying to set up IPsec VPN between Cisco ASA 5505 8.2(5) and MikroTik 6.40.5. The whole configuration looks good for me, but it isn't working properly. I can ping MikroTik's inside IP address (10....
1
vote
1answer
234 views

VPN Hardware Client with Split Tunneling (How do I design this?)

I want to implement a network design for my home office that has the capabilities of connecting to a VPN or Tunneling service and performs Split Tunneling within the network appliances. The reason ...