Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

31 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
1k views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
4
votes
0answers
507 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
3
votes
0answers
170 views

IPSec Tunnel not coming up: Issue with ACL?

I'm trying to bring up a IPsec tunnel between router and a bridge. I can see the Ipsec tunnel configurations are up and running but I think I have made a mistake in the ACL and hence the encr and decr ...
3
votes
0answers
2k views

Multiple IPSec Tunnels on Cisco router's interface

I an trying to configure 2 IPSEC VPSN Tunnels on the Cisco 1941 WAN Port. The tunnel with the higher crypto map sequence pre-empts the lower sequence number so only one tunnel is active at a time. I ...
2
votes
0answers
35 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
2
votes
0answers
710 views

GRE over IPsec problem

I'm trying to build a GRE Tunnel with IPSec encryption between two routers, but I keep getting error message saying "%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet..." Immediately I ...
2
votes
0answers
943 views

RSA key not working with trustpoint used for IPSec

I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup. Importing is ...
2
votes
1answer
5k views

IPSec IKEv2 connection failure due to RSA authentication issue

I'm trying to get an IPSec/IKEv2 setup working, which was implement following this I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
2
votes
0answers
2k views

IPsec IKEv2 with StrongSwan Cert+EAP not working

I'm trying to setup a Cisco router (881H) to act as a head end for an IPsec IKEv2 VPN. The target setup is meant to be used by StrongSWan clients (currently testing on Android smartphone), and we wish ...
1
vote
1answer
1k views

Traceroute through IPSec tunnel

askk Hi. When I do traceroute from host 192.168.11.0/24 to the server 10.0.0.0/24, which is site B. When the packets get into the public area it show Request timed out (as shown in this figure). I'm ...
1
vote
0answers
375 views

Why do the tunnel protocol on these two router show different values

Two routers R1 and R2 have a tunnel built between them in the 103.103.103.0/24 network. The end point of the tunnel are 75.75.75.2(on R1) and 76.76.76.2(on R2). Can anyone explain why does the Tunnel ...
1
vote
0answers
814 views

Quagga BGP failover

I'm using Quagga + BGP with Racoon IPSec to connect to AWS VPN tunnel. AWS provides 2 tunnels for redundancy. Everything is working with fine with Asymmetric routing in place. To test failover, I ...
1
vote
0answers
70 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
1
vote
0answers
497 views

Unable to receive return packets on Azure IPSEC VPN Connection

Trying to get the VPN tunnel to Azure working on a Cisco ISR 1941 but have been unable to get any traffic flowing back from Azure to site. The tunnel looks to be up and a machine in Azure is ...
1
vote
0answers
911 views

Connection problem, site-to-site, VYOS

I'm having problem with a site-to-site. I think I have the basic setup working and I want to confirm that the tunnel is up and working. Here is what I have: vyos@<vpnxy>:~$ show vpn ipsec sa ...
1
vote
0answers
418 views

Change RADIUS auth method for remote access ipsec vpn

We have a Cisco 3825 router with an IPSec Remote Access VPN configured to authenticate against a radius server. We're retiring the old server and moving to a new one (Windows Server 2012). We changed ...
1
vote
0answers
70 views

Issue with voice performance between two ip phones at the same site connecting to two different CUCM?

I have one branch which is (branch-1) with two groups of ip phones, one group is connecting to CUCM-1 in HQ and the other group is connecting to CUCM-2 in the branch (branch-1) and the connectivity ...
1
vote
0answers
5k views

VPN tunnel connection issue

My company has 2 ASA firewall with model 5510 & 5512 in difference country, I was connected it via IPSEC VPN. It can work in normal until 2 weeks ago. I checked from log in ASA5512 firewall, it ...
1
vote
0answers
492 views

ipsec tunnel between Cisco IOS router and Perle IOLAN SCS 32

I cannot get a IPsec tunnel up and run between a Perle IOLAN SCS 32 with firmware 4.5 and Cisco ASR 1001 with IOS XE 15.3 - it fails in phase 2 with invalid proposals Has some out there a sample for ...
0
votes
0answers
31 views

IPSEC Over GRE and GRE Over IPSEC

Can you show me example configuration IPSEC Over GRE and GRE Over IPSEC in Cisco IOS. I founded only example configuration GRE OVER IPSEC
0
votes
0answers
23 views

static IP multicast routing with IPSEC

for a specific application, I need to route a multicast flow with IPSEC (we use a CISCO ASA 5508 firewall), I am not a network expert then I will try to explain as best as I can our issue I don't need ...
0
votes
0answers
29 views

Does multicast over tunnels (e.g., GRE) require IGMP/MLD?

When subscribing to a multicast group on a tunnel device such as a GRE tunnel, are you supposed to participate in IGMP/MLD over that tunnel in order to announce your membership in the multicast group? ...
0
votes
0answers
23 views

Editing a crypto map with multiple entries

We're attempting to bring up an IPSEC tunnel with a Vendor. An engineer created the crypto map and wasnt able to establish a connection. I edited the entry to change the diffie-hillman group and the ...
0
votes
0answers
27 views

network cutover for remote site from L2 to L3 over IPSec tunnel

I have been trying to cutover one of our remote sites (A) to the new ISP we have purchased. The existing setup is utilizing L2 through another remote site (B) and coming back to the main campus. The ...
0
votes
0answers
30 views

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6?

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6 ?
0
votes
0answers
152 views

QoS over IPSec Site-to-Site VPN: Concerns and Questions

(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
0
votes
0answers
53 views

IKE Main Mode - Dynamic peers

So i searched for some time now, read the https://tools.ietf.org/html/rfc2409RFC and simply couldn't find an answer to why Main Mode needs static adresses. The RFC states Aggressive Mode does not ...
0
votes
1answer
191 views

Site-to-site IPsec and rerouting to another IPsec tunnel

We have three different geo sites (SITE1, SITE2 and SITE3) and each site has PFSense firewall installed. Sites have been connected together with IPSec tunnels. Also Site2 is connected to customer ...
0
votes
0answers
101 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
0
votes
0answers
50 views

IPSec Tunnel is up but no Communication with End Systems?

I need help for IPSec tunnel. Currently, I am working on a small task to create remote access between my laptop and office router, in order to access the office LAN network. IPSec tunnel is working ...
0
votes
0answers
399 views

Query on Cisco IPsec Licensing, HSEC-K9

I'm currently debugging an issue with IPsec tunnels and it seems like one of our client's NW engineers didn't install the HSEC-K9 license. The issue is that the new IPsec tunnels are not coming up ...