Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

73
votes
3answers
57k views

What's the difference between IKE and ISAKMP?

I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly)....
28
votes
8answers
32k views

What are the downsides of OpenVPN?

I have been seeing so many people always wrestling with IPSec, and many other secure VPN technologies. I, for one, have always simply used OpenVPN, with beautiful and simple and versatile results. I'...
13
votes
1answer
41k views

Getting Cisco ISAKMP and IPSec SA lifetime confused

I always get confused about security association lifetime configuration on Cisco IOS. On most web-managed hardware it is clear which SA lifetime is for Phase I and which is for Phase II. On Cisco ...
12
votes
1answer
14k views

Cisco ISR G2 encrypted bandwidth restriction?

I have been having complaints of a "slow connection" from several new remote sites. The sites are connected via an MPLS L3VPN service into Cisco 2921's, and we are using Cisco GET-VPN to encrypt ...
10
votes
1answer
468 views

Dynamic Crypto Map with IPv6 access list

I am trying to configure a dynamic crypto map for use on a pure IPv6 network, on Cisco 15.2M. The problem is when I try to add an ipv6 access list to the dynamic crypto map, I get an error message. ...
9
votes
2answers
10k views

In IPsec VPN, how is the pre-shared key encrypted?

I was doing IPsec VPN on ASA 8.0, and I understand a little about that. The initiator starts by sending its ISAKMP policy to the responder, and the responder sends back the matched policy. After that, ...
9
votes
2answers
383 views

Will ASA 5540 support 3000 simultaneous IPsec connections?

As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 ...
9
votes
2answers
5k views

What is the proper way to config a Site to Site IPSEC VPN and a Remote Access VLAN on the same external interface? Cisco 891 ISR

I'd be happy to post the config or logs for reference but I am having trouble getting my remote access VPN working on the same interface as my site to site IPSEC VPN. I am using a dynamic crypto map ...
8
votes
2answers
2k views

VPN's in cloud hosting/dedicated server environments, IPSec tunnels vs tinc

I am in the process of designing a virtual private network setup for a cloud hosting environment. Given our requirements I don't really see this as different from a dedicated server environment. The ...
8
votes
2answers
1k views

Cisco IPSec Site-to-site VPN. Permit traffic if VPN is down

Bit of 'belt and braces' configuration planning. Background: We have a successful site-to-site VPN link to our remote datacenter. The remote 'protected' network is also the IP network range that is ...
7
votes
1answer
5k views

How to failover static ipsec vpn tunnels?

I have a network with resilient gateways whereby Customer sites use a default gateway to reach the internet edge routers and the primary route for traffic uses a lower metric. ipsec tunnels are ...
7
votes
1answer
13k views

Timeouts for ASA VPN peers

I have configured a remote site with two IP addresses for data centre VPN peers - one primary (1.1.1.1), one backup (2.2.2.2). When the primary peer fails, the remote site detects the failure using ...
7
votes
1answer
12k views

Ipsec vpn, phase 2 unable to come up

I'm pretty sure I know the answer to this but I don't know how to implement it. Trying to setup an ipsec vpn from a Cisco 2811 to a linux box running openswan. So far I can get phase 1 up but ...
7
votes
2answers
7k views

NAT with VPN Site to Site and Remote LANs with same IP address

I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...). For every remote LAN, I ...
6
votes
1answer
9k views

Using a Cisco router as an L2TP client?

I have a customer that for various reasons has a Cisco router sitting behind a NATed ADSL connection. They want to create a VPN to one of our points of presence and the only options we offer are site ...
6
votes
1answer
1k views

After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel

After upgrading our ASAs from 9.1(1) to newer versions, users were no longer able to connect using native IPsec VPN client software when inside of an office network. From outside networks it still ...
6
votes
3answers
4k views

Problem with remote access, fixed L2L and dynamic L2L IPSEC working together on ASA 5540 8.2

I have an issue with a mixture of remote access, L2L and dynamic L2L tunnels on an ASA5540 running 8.2 Here is a snip of the relevant config:- crypto dynamic-map outside-crypto-dynamic-map 10 match ...
6
votes
2answers
4k views

How to configure Cisco remote access IPSEC VPN between IOS Router and Android phone

I have a C891FW router with IOS 15.4 on which I'm trying to configure a remote access VPN for Android's native VPN client. I'm authenticating with RSA-Sig and XAUTH. The tunnel forms but I can't reach ...
5
votes
4answers
4k views

How to make IPSEC over double NAT?

I need to have a site to site VPN between two sites. Here is the following topology for each site: Site A: One Cisco 1921 WAN port (192.168.3.2) connected to ISP router (192.168.3.66), both the ...
5
votes
1answer
18k views

Cisco IPSEC VPN fail Stage 2

The HUB is managed at a data center with external IP 200.200.200.200. There are 10 remote offices. Office 9 HUB 10.1.9.0 - 100.100.100.100 ->> VPN <<-...
5
votes
1answer
942 views

Deploying an IPSEC secure-channel - isakmp SA empty

I am currently trying to encrypt traffic in an IPSEC tunnel with a simple lab architecture. The architecture looks like this : I am trying to mount an IPSEC tunnel between Router A & Router B, ...
5
votes
1answer
1k views

Juniper SRX to SRX site-to-site VPN over existing WAN in trust zone

I have a client with 5 sites, each using their own private LAN subnet. They are currently using a service provider to link their branches and for Internet breakout centrally. I need to break them out ...
5
votes
2answers
14k views

Openswan Site-to-site VPN — cannot respond to IPsec SA request because no connection is known

I am setting up a ISPEC tunnel between a Linux System running Openswan and a Cisco ASA 5505. The strange thing is, the tunnel comes up I believe (based on the screenshots below), but I can't get ...
4
votes
1answer
80 views

Confused on perfect forward secrecy, someone kindly help me

i just read following article In IPsec VPN, how is the pre-shared key encrypted? got knowledge about phase 1 also basic line over PFS: for every new negotiation of Phase 2 SA the 2 gateways must ...
4
votes
2answers
3k views

Why do multi-line crypto ACL's create instability in VPN tunnels?

Why does using multiple sets of specific ip's to specific ip's in a crypto ACL - cause instability in VPN tunnels, please relate this to phase 2 SA's (IPSEC). Ex. 172.16.0.0 -> 10.0.0.0 172.17.0....
4
votes
1answer
8k views

Can we change peer IP of IPSec VPN tunnel in one line?

If I have a crypto map with a line as follows: crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8 Can I change that simply by typing the following in conf t: # crypto map Outside_map 10 set peer 0....
4
votes
1answer
188 views

Use cases for GRE over IPSEC

I'm trying to understand use cases for GRE over IPSEC. In the diagram below, each site uses GRE to encapsulate multicasts associated with OSPF. (There is still a requirement to configure SAs between ...
4
votes
1answer
3k views

IPSec failure with `IKE message failed its sanity check or is malformed`

I've been battling with my IPSec configuration for some days (with foolish deadline looming) and would like to ask for help with it failing its initial connection. It's designed as client-to-router ...
4
votes
1answer
231 views

Does any router support line-speed throughput for a single IPSec tunnel?

Has anyone achieved line-speed or close to line-speed throughput on a SINGLE IPSec tunnel on a 10Gbps port? If this is not possible, what would be a reasonable throughput (w.r.t interface speed) to ...
4
votes
1answer
650 views

Have Cisco ASA 5505 and want it to maintain site-to-site VPN connections

Background: A client has been hitting the host limit for his license on a Cisco ASA 5505. The license has a max of 50 clients that can access the internet, the 51st connection gets dropped. He has ...
4
votes
2answers
512 views

Can I do a pure IPSec VPN (no L2TP) with NAT-T where the server is inside a NAT?

Topology: Client -> Client Router -> CLOUD <- Server Router <- Server 10.0.1.5 10.0.1.1 <-NAT-> 100.1.1.1 200.1.1.1 <-NAT-> 192....
4
votes
2answers
362 views

IPsec tunnel configuration question

I have a network that is comprised of a main office and multiple branch offices. The main office houses the servers and each branch office has an IPsec tunnel to the main office. There are no ...
4
votes
2answers
15k views

Cisco ASA 5506-X - Site-to-Site VPN Tunnel - Return traffic dropped

I've configured a Cisco ASA 5506-X for a customer of mine and I'm having trouble successfully passing traffic round-trip to the remote network. The VPN tunnel connects successfully according to 'show ...
4
votes
1answer
4k views

Fortigate 30D IPSEC VPN could not locate phase1 configuration

Hello network engineers, I have an IPSEC VPN tunnel between two offices, the HQ is a fortigate 200B(os:v5.0,build0292 (GA Patch 9)) and the branch is fortigate 30D(os:5.2.3). Both are now on static ...
4
votes
2answers
4k views

Cisco IPSec VPN is not working

I'm trying to establish an IPSec VPN connection between my site and an ISP. I have a Cisco 1941 router and a Cisco firewall on the ISP side. I set up the configuration according to what the ISP has ...
3
votes
3answers
5k views

How to check if IPSec is available on Cisco ISR 4451

On a Cisco isr 4451 with base image I need to check if IPSec is available. Is there an command to list available vpn features? UPDATE The image name includes K9 (UNIVERSALK9-M) but the command failed ...
3
votes
1answer
267 views

IPSec/GRE over Metro-E traffic question

I am trying to run IPSec GRE over a MetroE circuit: ROUTER---------metroe----------ROUTER The routers are set up to route all traffic over the ipsec tunnel; however, when I check the routers I see ...
3
votes
1answer
193 views

How IPsec tunnel mode work without GRE

IPsec tunnel mode encrypt a whole IP packet and sends it as the payload of another IP packet. I have always used GRE as the encapsulation layer when doing IPsec encryption. However, how could I have ...
3
votes
1answer
2k views

IPSec site-to-site with/without NAT

I am connecting my office to a client's network via IPSec. The need is for me to connect directly to internal IPs on their network; there is no need for them to connect to any services on my internal ...
3
votes
1answer
1k views

Ports in IPSec tunnel

I'm trying to draw the packets in a network that uses an IPSec tunnel for security. More specifically: a laptop user using a public access point wants to query Google through an IPSec tunnel to a home ...
3
votes
3answers
5k views

How does one configure Cisco router for IPSec VPN for use with Windows 7 built in VPN client?

Actually, I would like to allow users to use either the 64-bit Cisco VPN client or the Windows 7 built in client. Is this possible? Additional information: The IOS host is the 881w-A-K9 ISR running ...
3
votes
2answers
465 views

IKE phase 1 and phase 2

Was going through the IKE phase 1 and phase 2. I have some questions regarding the same which is bothering me with respect to main mode and quick mode.Please correct me if i go wrong somewhere. Phase ...
3
votes
3answers
292 views

Layer 3 tunnel with Dynamic IP address

I want to ask whether it is possible to configure Layer 3 Tunnel with the two end points/interfaces have dynamic IP address? If the interface IP change, the tunnel will have to be re-negotiated, is ...
3
votes
1answer
2k views

IPsec Tunnel is showing decrypt packets counter but 0 encryption packets: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

I have just configured the IPSEC tunnel between my router and the Access point.I could see that the Tunnel has came up and Active in both sides. However,When I checked the "Show cyrpto ipsec sa" ,I ...
3
votes
2answers
183 views

Why does IPSec in transport mode not guarantee integrity?

Wikipedia says: Unlike Authentication Header (AH), ESP in transport mode does not provide integrity and authentication for the entire IP packet. I don't understand why this would be true. What is ...
3
votes
1answer
198 views

How troubleshoot poor ipsec connection?

I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers ...
3
votes
1answer
647 views

Asymmetric routing issue

Please find the network diagram, We have MPLS and Internet connectivity in our some of spoke sites in Hub router running in IPSLA for failure purpose. Here MPLS is the primary and VPN is the ...
3
votes
1answer
2k views

L2tp/IPSEC vs pure IPSEC

So, I was reading about the L2TP protocol and I understand what it basically does. But I fail to see why it would be preferred over pure IPSEC(VPN). VPN already provides end-to-end encryption between ...
3
votes
1answer
12k views

ASA tunnel up but not passing traffic

I have two offices (Victoria at IP 1.2.3.4 and Toronto at IP 5.6.7.8) each with pfSense running Strongswan, and each with an IKEv2 IPSec tunnel back to a Cisco ASA 5512 at IP 9.8.7.6. I recently ...
3
votes
5answers
7k views

Propagate VLAN through VPN (IPsec)?

I have a question about connecting two LANs (logically same LAN) over a VPN. In picture below you can see overall representation of our implementation. Description: On each side, we have distinct ...