People who code: we want your input. Take the Survey

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
77
votes
4answers
73k views

What's the difference between IKE and ISAKMP?

I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly)....
31
votes
8answers
34k views

What are the downsides of OpenVPN?

I have been seeing so many people always wrestling with IPSec, and many other secure VPN technologies. I, for one, have always simply used OpenVPN, with beautiful and simple and versatile results. I'...
13
votes
1answer
49k views

Getting Cisco ISAKMP and IPSec SA lifetime confused

I always get confused about security association lifetime configuration on Cisco IOS. On most web-managed hardware it is clear which SA lifetime is for Phase I and which is for Phase II. On Cisco ...
12
votes
1answer
15k views

Cisco ISR G2 encrypted bandwidth restriction?

I have been having complaints of a "slow connection" from several new remote sites. The sites are connected via an MPLS L3VPN service into Cisco 2921's, and we are using Cisco GET-VPN to encrypt ...
11
votes
2answers
14k views

In IPsec VPN, how is the pre-shared key encrypted?

I was doing IPsec VPN on ASA 8.0, and I understand a little about that. The initiator starts by sending its ISAKMP policy to the responder, and the responder sends back the matched policy. After that, ...
11
votes
3answers
5k views

What is the proper way to config a Site to Site IPSEC VPN and a Remote Access VLAN on the same external interface? Cisco 891 ISR

I'd be happy to post the config or logs for reference but I am having trouble getting my remote access VPN working on the same interface as my site to site IPSEC VPN. I am using a dynamic crypto map ...
10
votes
2answers
422 views

Will ASA 5540 support 3000 simultaneous IPsec connections?

As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 ...
10
votes
1answer
524 views

Dynamic Crypto Map with IPv6 access list

I am trying to configure a dynamic crypto map for use on a pure IPv6 network, on Cisco 15.2M. The problem is when I try to add an ipv6 access list to the dynamic crypto map, I get an error message. ...
9
votes
2answers
2k views

VPN's in cloud hosting/dedicated server environments, IPSec tunnels vs tinc

I am in the process of designing a virtual private network setup for a cloud hosting environment. Given our requirements I don't really see this as different from a dedicated server environment. The ...
9
votes
2answers
1k views

Cisco IPSec Site-to-site VPN. Permit traffic if VPN is down

Bit of 'belt and braces' configuration planning. Background: We have a successful site-to-site VPN link to our remote datacenter. The remote 'protected' network is also the IP network range that is ...
8
votes
1answer
6k views

How to failover static ipsec vpn tunnels?

I have a network with resilient gateways whereby Customer sites use a default gateway to reach the internet edge routers and the primary route for traffic uses a lower metric. ipsec tunnels are ...
8
votes
2answers
7k views

NAT with VPN Site to Site and Remote LANs with same IP address

I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...). For every remote LAN, I ...
7
votes
1answer
11k views

Using a Cisco router as an L2TP client?

I have a customer that for various reasons has a Cisco router sitting behind a NATed ADSL connection. They want to create a VPN to one of our points of presence and the only options we offer are site ...
7
votes
4answers
7k views

How to make IPSEC over double NAT?

I need to have a site to site VPN between two sites. Here is the following topology for each site: Site A: One Cisco 1921 WAN port (192.168.3.2) connected to ISP router (192.168.3.66), both the ...
7
votes
1answer
14k views

Timeouts for ASA VPN peers

I have configured a remote site with two IP addresses for data centre VPN peers - one primary (1.1.1.1), one backup (2.2.2.2). When the primary peer fails, the remote site detects the failure using ...
7
votes
3answers
4k views

Problem with remote access, fixed L2L and dynamic L2L IPSEC working together on ASA 5540 8.2

I have an issue with a mixture of remote access, L2L and dynamic L2L tunnels on an ASA5540 running 8.2 Here is a snip of the relevant config:- crypto dynamic-map outside-crypto-dynamic-map 10 match ...
7
votes
1answer
13k views

Ipsec vpn, phase 2 unable to come up

I'm pretty sure I know the answer to this but I don't know how to implement it. Trying to setup an ipsec vpn from a Cisco 2811 to a linux box running openswan. So far I can get phase 1 up but ...
6
votes
1answer
22k views

Cisco IPSEC VPN fail Stage 2

The HUB is managed at a data center with external IP 200.200.200.200. There are 10 remote offices. Office 9 HUB 10.1.9.0 - 100.100.100.100 ->> VPN <<-...
6
votes
1answer
1k views

After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel

After upgrading our ASAs from 9.1(1) to newer versions, users were no longer able to connect using native IPsec VPN client software when inside of an office network. From outside networks it still ...
6
votes
2answers
6k views

How to configure Cisco remote access IPSEC VPN between IOS Router and Android phone

I have a C891FW router with IOS 15.4 on which I'm trying to configure a remote access VPN for Android's native VPN client. I'm authenticating with RSA-Sig and XAUTH. The tunnel forms but I can't reach ...
5
votes
1answer
9k views

IPSec failure with `IKE message failed its sanity check or is malformed`

I've been battling with my IPSec configuration for some days (with foolish deadline looming) and would like to ask for help with it failing its initial connection. It's designed as client-to-router ...
5
votes
2answers
17k views

Cisco ASA 5506-X - Site-to-Site VPN Tunnel - Return traffic dropped

I've configured a Cisco ASA 5506-X for a customer of mine and I'm having trouble successfully passing traffic round-trip to the remote network. The VPN tunnel connects successfully according to 'show ...
5
votes
1answer
1k views

Deploying an IPSEC secure-channel - isakmp SA empty

I am currently trying to encrypt traffic in an IPSEC tunnel with a simple lab architecture. The architecture looks like this : I am trying to mount an IPSEC tunnel between Router A & Router B, ...
5
votes
2answers
876 views

Can I do a pure IPSec VPN (no L2TP) with NAT-T where the server is inside a NAT?

Topology: Client -> Client Router -> CLOUD <- Server Router <- Server 10.0.1.5 10.0.1.1 <-NAT-> 100.1.1.1 200.1.1.1 <-NAT-> 192....
5
votes
1answer
1k views

Juniper SRX to SRX site-to-site VPN over existing WAN in trust zone

I have a client with 5 sites, each using their own private LAN subnet. They are currently using a service provider to link their branches and for Internet breakout centrally. I need to break them out ...
5
votes
2answers
15k views

Openswan Site-to-site VPN — cannot respond to IPsec SA request because no connection is known

I am setting up a ISPEC tunnel between a Linux System running Openswan and a Cisco ASA 5505. The strange thing is, the tunnel comes up I believe (based on the screenshots below), but I can't get ...
4
votes
2answers
154 views

Is Cisco IPsec different from ordinary IPsec?

Is Cisco IPsec different from ordinary IPsec? Although Windows 10 has built-in VPN support for L2TP/IPSec, it does not support IPSec provided by Cisco. Thus, we generally need to install hand-made ...
4
votes
1answer
107 views

Confused on perfect forward secrecy, someone kindly help me

i just read following article In IPsec VPN, how is the pre-shared key encrypted? got knowledge about phase 1 also basic line over PFS: for every new negotiation of Phase 2 SA the 2 gateways must ...
4
votes
2answers
4k views

Why do multi-line crypto ACL's create instability in VPN tunnels?

Why does using multiple sets of specific ip's to specific ip's in a crypto ACL - cause instability in VPN tunnels, please relate this to phase 2 SA's (IPSEC). Ex. 172.16.0.0 -> 10.0.0.0 172.17.0....
4
votes
1answer
8k views

Can we change peer IP of IPSec VPN tunnel in one line?

If I have a crypto map with a line as follows: crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8 Can I change that simply by typing the following in conf t: # crypto map Outside_map 10 set peer 0....
4
votes
1answer
591 views

How IPsec tunnel mode work without GRE

IPsec tunnel mode encrypt a whole IP packet and sends it as the payload of another IP packet. I have always used GRE as the encapsulation layer when doing IPsec encryption. However, how could I have ...
4
votes
1answer
511 views

Use cases for GRE over IPSEC

I'm trying to understand use cases for GRE over IPSEC. In the diagram below, each site uses GRE to encapsulate multicasts associated with OSPF. (There is still a requirement to configure SAs between ...
4
votes
2answers
1k views

IKE phase 1 and phase 2

Was going through the IKE phase 1 and phase 2. I have some questions regarding the same which is bothering me with respect to main mode and quick mode.Please correct me if i go wrong somewhere. Phase ...
4
votes
1answer
306 views

Does any router support line-speed throughput for a single IPSec tunnel?

Has anyone achieved line-speed or close to line-speed throughput on a SINGLE IPSec tunnel on a 10Gbps port? If this is not possible, what would be a reasonable throughput (w.r.t interface speed) to ...
4
votes
2answers
393 views

IPsec tunnel configuration question

I have a network that is comprised of a main office and multiple branch offices. The main office houses the servers and each branch office has an IPsec tunnel to the main office. There are no ...
4
votes
1answer
657 views

Have Cisco ASA 5505 and want it to maintain site-to-site VPN connections

Background: A client has been hitting the host limit for his license on a Cisco ASA 5505. The license has a max of 50 clients that can access the internet, the 51st connection gets dropped. He has ...
4
votes
3answers
6k views

How does one configure Cisco router for IPSec VPN for use with Windows 7 built in VPN client?

Actually, I would like to allow users to use either the 64-bit Cisco VPN client or the Windows 7 built in client. Is this possible? Additional information: The IOS host is the 881w-A-K9 ISR running ...
4
votes
1answer
882 views

IOS to ASA dynamic and static VPNs - sharing same crypto ACL?

Is it possible to have a dynamic and static VPN between the same IOS router and ASA, sharing same interesting traffic/crypto ACL on the ASA end? The two devices in question: ASA 9.1 - hub/termination ...
4
votes
2answers
3k views

Juniper SRX blank proxy-identity

I would really appreciate some clarification in the following matter. What I'm seeing I'm looking at two different SRX210 firewalls and specifically at their ipsec stanza. I'm seeing the following ...
4
votes
1answer
5k views

Fortigate 30D IPSEC VPN could not locate phase1 configuration

Hello network engineers, I have an IPSEC VPN tunnel between two offices, the HQ is a fortigate 200B(os:v5.0,build0292 (GA Patch 9)) and the branch is fortigate 30D(os:5.2.3). Both are now on static ...
4
votes
1answer
9k views

ASA VPN works as responder but not as initiator

I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.) When the pfSense starts the connection, everything works fine. When the ...
4
votes
2answers
5k views

Cisco IPSec VPN is not working

I'm trying to establish an IPSec VPN connection between my site and an ISP. I have a Cisco 1941 router and a Cisco firewall on the ISP side. I set up the configuration according to what the ISP has ...
4
votes
1answer
21k views

Sonicwall not fowarding VPN traffic over tunnel

My office network is 10.25.0.0/16. I have a VPC in Amazon that's 10.100.0.0/16, and I have a VPN established between the office and the VPC using Amazon's Virtual Private gateway. This connection ...
4
votes
3answers
4k views

ISAKMP packet captures

I need to confirm my understanding of IPSEC phase 1. As per my understanding in the capture below, the first 2 messages are agreeing on the parameters, the next 2 are key exchange the final 2 is ...
4
votes
1answer
2k views

Setup IPSec VPN to a node behind another Pfsense Box

I have a pfsense box (Call this BOX1) that has LANs and a WAN which connects to the internet and is used to create a VPN connection to a client: This has pfsense version 2.0.2-RELEASE (i386) I have a ...
4
votes
0answers
1k views

Cisco ASA IPsec tunnel QM FSM error

I am setting up Cisco 5585 ASA for IPsec tunnel with one of cloud company. we already have lots of tunnel for various cloud provider and life if good but recently this tunnel giving me hard time to ...
4
votes
0answers
512 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
3
votes
3answers
10k views

How to check if IPSec is available on Cisco ISR 4451

On a Cisco isr 4451 with base image I need to check if IPSec is available. Is there an command to list available vpn features? UPDATE The image name includes K9 (UNIVERSALK9-M) but the command failed ...
3
votes
1answer
299 views

IPSec/GRE over Metro-E traffic question

I am trying to run IPSec GRE over a MetroE circuit: ROUTER---------metroe----------ROUTER The routers are set up to route all traffic over the ipsec tunnel; however, when I check the routers I see ...
3
votes
1answer
6k views

IPSec based VPN using Openswan - IP confusion [closed]

I am currently trying to route traffic from one Linux box (local VM for testing purposes) to my Linux (Debian) server with the intent to use NAT. I was told to use IPSec to get my data to said server ...

1
2 3 4 5 6