Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
1
vote
2answers
2k views

Keep Cisco site-to-site tunnel up permanently

I have Cisco ASA site-to-site tunnel with remote and which i don't have control. I have following config: crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 2 ...
2
votes
2answers
2k views

How to keep an ASA tunnel up for lifetime?

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening: When I send a packet or generate interesting traffic, it brings up the tunnel and everything ...
0
votes
0answers
20 views

Editing a crypto map with multiple entries

We're attempting to bring up an IPSEC tunnel with a Vendor. An engineer created the crypto map and wasnt able to establish a connection. I edited the entry to change the diffie-hillman group and the ...
0
votes
2answers
38 views

Why does IPSec's Transport Mode ESP can't be used in NAT64 although ESP doesn't sign the new IP header?

In RFC6146 stated: Any protocols that protect IP header are incompatible with NAT64. This implies that end-to-end IPsec verification will fail when the Authentication Header (AH) is used (both ...
1
vote
2answers
632 views

IKEv2 tunnel between ASA and Mikrotik

Trying to move from pfSense to Mikrotik for an office router, and the only stumbling block is maintaining a site-to-site IPSEC tunnel between it and our Cisco ASA. The settings all look correct to me, ...
1
vote
1answer
23 views

IKEv2 notification payload regarding IKE SA

I am puzzled about two paragraphs regarding a notification payload in section 3.10 of RFC7296. There you can find the following: o Protocol ID (1 octet) - If this notification concerns an existing ...
1
vote
1answer
41 views

Is an IPSec connection between 2 devices behind NAT possible?

We have tens of IPSec connections between our office and customer site's. We use an extra router in the customer network (so behind NAT) to initiate the connection to our office where a PFSense router ...
0
votes
1answer
46 views

Access IPSec site from another IPSec site

Our company delivers, installs and maintains custom build hardware at customer sites. In all cases the delivered setup contains at least 1 server and 2 network devices. To keep the control over the ...
0
votes
2answers
48 views

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

This question is about encryption in data communications, defined broadly to include: Line scrambling at layer 1 MACsec at layer 2 IPsec at layer 3 TLS at layer 4 etc. All of these encryption ...
1
vote
1answer
736 views

Traceroute through IPSec tunnel

askk Hi. When I do traceroute from host 192.168.11.0/24 to the server 10.0.0.0/24, which is site B. When the packets get into the public area it show Request timed out (as shown in this figure). I'm ...
1
vote
3answers
99 views

But confused about SSL VPN and IPsec Site -Site VPN

What might be difference between sslvpn and site-site vpn . Which one among two is secure and it's significance
2
votes
1answer
107 views

Confusion about Route based IPSEC site-site vpn and policy based IPSEC site-site VPN

I am confused about the major difference between a policy-based VPN and routed-based site-site Vpn
0
votes
2answers
39 views

Setup IPSEC in Hub/Spoke fashion

I'm trying to setup IPSEC tunnels in a hub/spoke type fashion. I've emulated this in GNS3 by creating three sites. Each site uses an IOSv router as it's WAN router. I'm using site 2 as the hub and ...
2
votes
2answers
16k views

Cisco ASA: Unable to establish IPSec tunnel with IKEv2: Auth exchange failed

This is a Cisco ASA 5515-X with software 9.6(3)20. The remote side didn't tell me what they use, must be Strongswan or something. Using the following debug commands debug crypto ipsec 255 debug ...
1
vote
1answer
57 views

Juniper QFX Site to Site VPN

Im trying to setup a site to site vpn between two Juniper QFX5110's. Each end of the link is on the same subnet (so directly connected switches over dark fibre). I have configured each physical ...
2
votes
1answer
4k views

IPSec IKEv2 connection failure due to RSA authentication issue

I'm trying to get an IPSec/IKEv2 setup working, which was implement following this I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
76
votes
4answers
70k views

What's the difference between IKE and ISAKMP?

I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly)....
0
votes
2answers
35 views

IPSEC between two offices with SAME local networks. How should I do nat? [duplicate]

I have two spokes with same local networks and want to do IPSEC between them. When I try to ping 172.17.214.111 from 192.168.5.0 (from right side to left side) I see packet on Cisco router and I see ...
0
votes
0answers
26 views

network cutover for remote site from L2 to L3 over IPSec tunnel

I have been trying to cutover one of our remote sites (A) to the new ISP we have purchased. The existing setup is utilizing L2 through another remote site (B) and coming back to the main campus. The ...
0
votes
3answers
57 views

Site-to-site IPSec tunnel over Load balancer

I'm having a following topology Could this be archived? I've configured this network, but routing between the two VLAN-s are not working. Using Ubiquity Edge X routers. Could this be archived with ...
0
votes
1answer
143 views

Is it possible to setup IPsec behind NAT without port forwarding?

We want to setup a IPsec connection between customer sites and our office so we can manage the hardware we place at customer sites (e.g. barriers). Its important that the VPN connection stays up all ...
0
votes
0answers
25 views

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6?

How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6 ?
1
vote
2answers
60 views

IPSec Tunnel Mode

Assuming an organisation has 2 offices at two different locations and needs secure communication between them. As far as I understand IPSec, we can use tunnel mode to provide end to end encryption for ...
4
votes
0answers
846 views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
0
votes
3answers
49 views

Do i need VLAN per customer when i want to give users (secure) access to specific customer sites

This question is a follow up on this question. We are currently working on the network design, nothing is implemented yet. Our network will exist out of our own (internal) network and lot of customer ...
11
votes
3answers
5k views

What is the proper way to config a Site to Site IPSEC VPN and a Remote Access VLAN on the same external interface? Cisco 891 ISR

I'd be happy to post the config or logs for reference but I am having trouble getting my remote access VPN working on the same interface as my site to site IPSEC VPN. I am using a dynamic crypto map ...
0
votes
1answer
64 views

Create IPSEC VPN between three Routers?

I'm attempt to build essentially an IPSEC tunnel mesh between three Cisco IOSv routers. I've been able to build an IPSEC tunnel between two directly connected routers but once I add the third router ...
0
votes
0answers
83 views

Hub and spoke IPSec in pfsense

I have 9 different sites and one HQ site where all 9 remote sites connect to via IPSec VPN. All are pfsense firewalls. I want to allow traffic between site 2, 3 and 4. But I do not want to configure ...
0
votes
1answer
1k views

IPSEC Phase 1 error

Was does the MM_NO_STATE usually mean when having errors bringing phase 1 up? IPv4 Crypto ISAKMP SA dst src state conn-id status X.X.X.122 X.X.X.107 MM_NO_STATE ...
0
votes
1answer
209 views

Cisco ASA IPSec Site-to-Site VPN Rx Bytes not increasing

I have IPsec Site-to-Site VPN from my ASA to customer. After customer complain about VPN down, I reset the tunnel now I can see Login time duration 12h:34m Byte TX is 543240 and Byte Rx is 0. What ...
0
votes
0answers
21 views

ipsec site to site vpn phase1 and phase2 negotiation

in ipsec site to site vpn, how initiator and responder negotiates in phase1 and phase2 and what is security association in phase1 and phase2 ? How ike correlate with oakley, Isakmp and Skeme ?
2
votes
0answers
35 views

CA certificate and Local certificate

There is something which is bothering me when i think about the CA cert and Local cert. Below are my queries which pertains to juniper but may be generic as well. 1) "request security pki ca-...
0
votes
0answers
10 views

Ipsec connection and nat only one site [duplicate]

There are two companies and two of them connected to each other with İPsec vpn. Company A has a server and company B want to reach to company A server. Which company need to configure nat on its ...
0
votes
0answers
69 views

QoS over IPSec Site-to-Site VPN: Concerns and Questions

(For clarification purposes: Kbps = Kilobits per second for bandwidth, KB/s = Kilobytes per second for file / data transfer stuff. I'm using them separately because XG knows KBps but not Kbps - ...
1
vote
1answer
40 views

IPSec does not work via backup interface

Cisco ASA 5506-X connected to two ISP - main and standby channel, interfaces outside_1 and outside_2. IPSec works via outside_1, but does not work via outside_2, if outside_1 down. At this moment ...
3
votes
1answer
343 views

Pass traffic from remote access to site to site tunnel [closed]

I have situation where remote access ipsec client have to connect to ASA firewall to send and receive traffic using site to site tunnel on the same ASA, in the logs I am seeing packets dropped as it ...
2
votes
1answer
55 views

Cisco 5505 ASA firewall Ipsec vpn- Can connect two outside different public ip to two different local subnets

I only get one IPSEC vpn connection up but not the other. Link to access configs on Google: https://drive.google.com/open?id=1yB_yIWvJ51A0UeNbkAEiTH9YMIEipqy_ profile1- outside interface - 66.x.x.x ...
0
votes
1answer
31 views

Site-to-Site IPSEC through load balancer with persistence

what I'm trying to achieve is a site to site IPSEC tunnel going through a load balancer, (both sites have pfsense and balancer is f5 big ip) the reason why i'm trying to do that is because: - Site A ...
0
votes
1answer
19 views

IP-Sec VPN Tunnel Established Between 2 Remote Machines. Why Can't Machines In Their Subnets Connect Across? [closed]

Have 2 Remote Ubuntu Machines in different subnets. one: 192.168.1.0/24 Two: 192.168.2.0/24 Established VPN tunnel between 2 machines, 1 in each subnet. Their IPs: Public IPs 1.1.1.1 2.2.2.2 ...
0
votes
2answers
522 views

Cisco ASA IKE Receiver: Runt ISAKMP packet discarded on Port 500

I have lots of ikev1 tunnel running on our production Cisco ASA5585 and today i have configured ikev2 tunnel for one of our new customer and i have started seeing following error, and not sure what is ...
0
votes
0answers
46 views

IKE Main Mode - Dynamic peers

So i searched for some time now, read the https://tools.ietf.org/html/rfc2409RFC and simply couldn't find an answer to why Main Mode needs static adresses. The RFC states Aggressive Mode does not ...
1
vote
1answer
240 views

Cisco dVTI - Virtual-Access interface has no IP address

i'm struggeling with some dVTI Issue on a Cisco ASR1000 box. here is my configuration for the hub site: crypto keyring FOO-KEYRING pre-shared-key hostname r2-foo key iawg8b32hah ! crypto isakmp ...
0
votes
1answer
87 views

IPsec VPN route in Checkpoint

I have created a ipsec VPN from site A (Cisco) to Site B (checkpoint R77.20). At site B, i have a static 1-1 NAT applied: ipx --ipy Tunnel is live and connection up; I can telnet my site B system ...
2
votes
2answers
70 views

SRX to ASA IPSec troubles

we built a VPN between partner's Cisco ASA (unknown version) and my Juniper SRX 340. The tunnel seems to go up properly: root@fw01> show security ike security-associations node0: ----------------...
3
votes
1answer
698 views

Ping unlocks ipsec vpn

I have a ipsec vpn with a foreign company, this connects my network with their network and they have a different ip subnet. Ipsec is made by a pfsense gateway/firewall. I'm sure it is well configured,...
1
vote
0answers
45 views

Chckpoint Remote Access VPN Multiple ISP external interface [closed]

I'm in a situation where I have to suggest the best solution when client has two ISP connected to a checkpoint firewall cluster. AFAIK, we cannot activate or make use of two external interfaces for ...
0
votes
3answers
182 views

IPSec VPN timers query

I have a couple of queries related to the IPSec VPN and I believe someone would clarify my doubts. Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating? Why ...
-1
votes
1answer
144 views

Site-to-site IPsec and rerouting to another IPsec tunnel

We have three different geo sites (SITE1, SITE2 and SITE3) and each site has PFSense firewall installed. Sites have been connected together with IPSec tunnels. Also Site2 is connected to customer ...
1
vote
0answers
53 views

IPsec tunnel with multiple networks NATed [closed]

I'm trying to set up an IPsec connection between two sites: our Azure network and our client's local network. To be flexible and avoid any current or potential future IP range overlappings I wand to "...
0
votes
1answer
445 views

How do you define interesting traffic using an IPSec Profile on a Cisco router?

I apologize if this is a duplicate, but I'm having difficulty figuring out how to define interesting traffic on a Cisco router using an IPSec Profile referenced by a tunnel interface. The old-school ...

1
2 3 4 5 6