Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

33 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
20 views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
3
votes
0answers
71 views

IPSec Tunnel not coming up: Issue with ACL?

I'm trying to bring up a IPsec tunnel between router and a bridge. I can see the Ipsec tunnel configurations are up and running but I think I have made a mistake in the ACL and hence the encr and decr ...
3
votes
1answer
123 views

Pass traffic from remote access to site to site tunnel

I have situation where remote access ipsec client have to connect to ASA firewall to send and receive traffic using site to site tunnel on the same ASA, in the logs I am seeing packets dropped as it ...
3
votes
0answers
407 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
2
votes
0answers
445 views

RSA key not working with trustpoint used for IPSec

I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup. Importing is ...
2
votes
1answer
2k views

IPSec IKEv2 connection failure due to RSA authentication issue

I'm trying to get an IPSec/IKEv2 setup working, which was implement following this I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
2
votes
0answers
2k views

IPsec IKEv2 with StrongSwan Cert+EAP not working

I'm trying to setup a Cisco router (881H) to act as a head end for an IPsec IKEv2 VPN. The target setup is meant to be used by StrongSWan clients (currently testing on Android smartphone), and we wish ...
2
votes
0answers
998 views

IPSEC VPN between Cisco IOS and Checkpoint SA failure, one way works

I am trying to hook up a VPN between us and a customer. Customer has a Checkpoint FW (not sure which version), I have a 2811. Symptom: The tunnel (session) comes up, I can ping through, other side ...
2
votes
0answers
1k views

High count of packet retransmissions/Dups over IPSEC/VPN

I'm running IPSEC-VPN (AES256/SHA256/DH14) tunnel between a PaloAlto PA-500 and a Fortigate 110C via Internet (10MBit up/down guaranteed both sides - latency between 40 and 50ms). 90% connections are ...
2
votes
0answers
2k views

Multiple IPSec Tunnels on Cisco router's interface

I an trying to configure 2 IPSEC VPSN Tunnels on the Cisco 1941 WAN Port. The tunnel with the higher crypto map sequence pre-empts the lower sequence number so only one tunnel is active at a time. I ...
2
votes
0answers
2k views

Setup IPSec VPN to a node behind another Pfsense Box

I have a pfsense box (Call this BOX1) that has LANs and a WAN which connects to the internet and is used to create a VPN connection to a client: This has pfsense version 2.0.2-RELEASE (i386) I have a ...
1
vote
0answers
97 views

GRE over IPsec problem

I'm trying to build a GRE Tunnel with IPSec encryption between two routers, but I keep getting error message saying "%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet..." Immediately I ...
1
vote
0answers
103 views

Why do the tunnel protocol on these two router show different values

Two routers R1 and R2 have a tunnel built between them in the 103.103.103.0/24 network. The end point of the tunnel are 75.75.75.2(on R1) and 76.76.76.2(on R2). Can anyone explain why does the Tunnel ...
1
vote
0answers
201 views

AWS tunnel TCP retransmissions and DUP ACKs

I have a IPsec tunnel from my firewall towards AWS, the tunnel is up in both phases. If I run traffic sniffer in the firewall, I can see interesting traffic going through, but there are MANY TCP ...
1
vote
0answers
721 views

Quagga BGP failover

I'm using Quagga + BGP with Racoon IPSec to connect to AWS VPN tunnel. AWS provides 2 tunnels for redundancy. Everything is working with fine with Asymmetric routing in place. To test failover, I ...
1
vote
0answers
65 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
1
vote
0answers
477 views

Unable to receive return packets on Azure IPSEC VPN Connection

Trying to get the VPN tunnel to Azure working on a Cisco ISR 1941 but have been unable to get any traffic flowing back from Azure to site. The tunnel looks to be up and a machine in Azure is ...
1
vote
0answers
879 views

Connection problem, site-to-site, VYOS

I'm having problem with a site-to-site. I think I have the basic setup working and I want to confirm that the tunnel is up and working. Here is what I have: vyos@<vpnxy>:~$ show vpn ipsec sa ...
1
vote
0answers
372 views

Change RADIUS auth method for remote access ipsec vpn

We have a Cisco 3825 router with an IPSec Remote Access VPN configured to authenticate against a radius server. We're retiring the old server and moving to a new one (Windows Server 2012). We changed ...
1
vote
0answers
69 views

Issue with voice performance between two ip phones at the same site connecting to two different CUCM?

I have one branch which is (branch-1) with two groups of ip phones, one group is connecting to CUCM-1 in HQ and the other group is connecting to CUCM-2 in the branch (branch-1) and the connectivity ...
1
vote
0answers
4k views

VPN tunnel connection issue

My company has 2 ASA firewall with model 5510 & 5512 in difference country, I was connected it via IPSEC VPN. It can work in normal until 2 weeks ago. I checked from log in ASA5512 firewall, it ...
1
vote
0answers
434 views

ipsec tunnel between Cisco IOS router and Perle IOLAN SCS 32

I cannot get a IPsec tunnel up and run between a Perle IOLAN SCS 32 with firmware 4.5 and Cisco ASR 1001 with IOS XE 15.3 - it fails in phase 2 with invalid proposals Has some out there a sample for ...
0
votes
0answers
12 views

IPsec VPN route in Checkpoint

I have created a ipsec VPN from site A (Cisco) to Site B (checkpoint R77.20). At site B, i have a static 1-1 NAT applied: ipx --ipy Tunnel is live and connection up; I can telnet my site B system ...
0
votes
0answers
27 views

IPsec tunnel with multiple networks NATed

I'm trying to set up an IPsec connection between two sites: our Azure network and our client's local network. To be flexible and avoid any current or potential future IP range overlappings I wand to "...
0
votes
0answers
9 views

Zywall USG 100 IPSec Routing

I own a Zywall USG 100, that manages 5 networks (2 WANs, 3 LANs); I built a site-to-site IPSec VPN with our CED, but now I'd like: to deny access to VPN from 2 of 3 above LANs, forcing them to reach ...
0
votes
1answer
91 views

Traceroute through ipsec tunnel

askk Hi when i do traceroute from host 192.168.11.0/24 to the server 10.0.0.0/24 which is site B when the packets get into the public area it show 'request timed out' as shown in this figure im using ...
0
votes
0answers
20 views

Multiple GETVPN groups inter-connectivity issue

Greeting Everyone!! I'm trying to stimulate an environment where I've DC and DR locations and remote sites have to access DC/DR services. For security, GETVPN is used. Initially tried using only one ...
0
votes
1answer
68 views

Site-to-site IPsec and rerouting to another IPsec tunnel

We have three different geo sites (SITE1, SITE2 and SITE3) and each site has PFSense firewall installed. Sites have been connected together with IPSec tunnels. Also Site2 is connected to customer ...
0
votes
0answers
20 views

does ipsec phase1 renewal keep connections?

I have an IPSec tunnel UP and I open a TCP connection when the phase1 expire and is renewed, Is the TCP connection supposed to stay alive or drop ? both in the theory and practical (cisco, ...
0
votes
0answers
58 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
0
votes
0answers
41 views

IPSec Tunnel is up but no Communication with End Systems?

I need help for IPSec tunnel. Currently, I am working on a small task to create remote access between my laptop and office router, in order to access the office LAN network. IPSec tunnel is working ...
0
votes
0answers
176 views

Query on Cisco IPsec Licensing, HSEC-K9

I'm currently debugging an issue with IPsec tunnels and it seems like one of our client's NW engineers didn't install the HSEC-K9 license. The issue is that the new IPsec tunnels are not coming up ...
0
votes
0answers
937 views

IPsec tunnel getting drop and reconnect itself frequently

We have IPsec tunnel which is working but somehow getting drop and reconnect itself and that causing disturbance in application, i am unable to find root cause. I have check isakmp and crypto map ...