People who code: we want your input. Take the Survey

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
1
vote
1answer
40 views

IPSec does not work via backup interface

Cisco ASA 5506-X connected to two ISP - main and standby channel, interfaces outside_1 and outside_2. IPSec works via outside_1, but does not work via outside_2, if outside_1 down. At this moment ...
3
votes
1answer
482 views

Pass traffic from remote access to site to site tunnel [closed]

I have situation where remote access ipsec client have to connect to ASA firewall to send and receive traffic using site to site tunnel on the same ASA, in the logs I am seeing packets dropped as it ...
2
votes
1answer
73 views

Cisco 5505 ASA firewall Ipsec vpn- Can connect two outside different public ip to two different local subnets

I only get one IPSEC vpn connection up but not the other. Link to access configs on Google: https://drive.google.com/open?id=1yB_yIWvJ51A0UeNbkAEiTH9YMIEipqy_ profile1- outside interface - 66.x.x.x ...
0
votes
1answer
78 views

Site-to-Site IPSEC through load balancer with persistence

what I'm trying to achieve is a site to site IPSEC tunnel going through a load balancer, (both sites have pfsense and balancer is f5 big ip) the reason why i'm trying to do that is because: - Site A ...
0
votes
1answer
20 views

IP-Sec VPN Tunnel Established Between 2 Remote Machines. Why Can't Machines In Their Subnets Connect Across? [closed]

Have 2 Remote Ubuntu Machines in different subnets. one: 192.168.1.0/24 Two: 192.168.2.0/24 Established VPN tunnel between 2 machines, 1 in each subnet. Their IPs: Public IPs 1.1.1.1 2.2.2.2 ...
0
votes
2answers
745 views

Cisco ASA IKE Receiver: Runt ISAKMP packet discarded on Port 500

I have lots of ikev1 tunnel running on our production Cisco ASA5585 and today i have configured ikev2 tunnel for one of our new customer and i have started seeing following error, and not sure what is ...
0
votes
0answers
56 views

IKE Main Mode - Dynamic peers

So i searched for some time now, read the https://tools.ietf.org/html/rfc2409RFC and simply couldn't find an answer to why Main Mode needs static adresses. The RFC states Aggressive Mode does not ...
1
vote
1answer
349 views

Cisco dVTI - Virtual-Access interface has no IP address

i'm struggeling with some dVTI Issue on a Cisco ASR1000 box. here is my configuration for the hub site: crypto keyring FOO-KEYRING pre-shared-key hostname r2-foo key iawg8b32hah ! crypto isakmp ...
0
votes
1answer
183 views

IPsec VPN route in Checkpoint

I have created a ipsec VPN from site A (Cisco) to Site B (checkpoint R77.20). At site B, i have a static 1-1 NAT applied: ipx --ipy Tunnel is live and connection up; I can telnet my site B system ...
2
votes
2answers
85 views

SRX to ASA IPSec troubles

we built a VPN between partner's Cisco ASA (unknown version) and my Juniper SRX 340. The tunnel seems to go up properly: root@fw01> show security ike security-associations node0: ----------------...
3
votes
1answer
743 views

Ping unlocks ipsec vpn

I have a ipsec vpn with a foreign company, this connects my network with their network and they have a different ip subnet. Ipsec is made by a pfsense gateway/firewall. I'm sure it is well configured,...
1
vote
0answers
54 views

Chckpoint Remote Access VPN Multiple ISP external interface [closed]

I'm in a situation where I have to suggest the best solution when client has two ISP connected to a checkpoint firewall cluster. AFAIK, we cannot activate or make use of two external interfaces for ...
0
votes
3answers
296 views

IPSec VPN timers query

I have a couple of queries related to the IPSec VPN and I believe someone would clarify my doubts. Why IKE Lifetime and IPSec Lifetime is used? Can't we just run the VPN without re-negotiating? Why ...
1
vote
0answers
69 views

IPsec tunnel with multiple networks NATed [closed]

I'm trying to set up an IPsec connection between two sites: our Azure network and our client's local network. To be flexible and avoid any current or potential future IP range overlappings I wand to "...
4
votes
1answer
882 views

IOS to ASA dynamic and static VPNs - sharing same crypto ACL?

Is it possible to have a dynamic and static VPN between the same IOS router and ASA, sharing same interesting traffic/crypto ACL on the ASA end? The two devices in question: ASA 9.1 - hub/termination ...
2
votes
1answer
1k views

IPsec, how to differentiate TCP and UDP

I read a little bit on the Wikipedia IPsec page. I was intrigued by: IPsec is an end-to-end security scheme operating in the Internet Layer of the Internet Protocol Suite I understand this as: ...
4
votes
2answers
154 views

Is Cisco IPsec different from ordinary IPsec?

Is Cisco IPsec different from ordinary IPsec? Although Windows 10 has built-in VPN support for L2TP/IPSec, it does not support IPSec provided by Cisco. Thus, we generally need to install hand-made ...
-1
votes
1answer
99 views

GRE over IPSec Transport vs. Tunnel Mode

I have a misunderstanding, in this article, Figure 4-9, in Transport Mode, first header (IPsec Hdr), is correct? Should not be GRE IP Hdr? https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/...
2
votes
0answers
775 views

GRE over IPsec problem

I'm trying to build a GRE Tunnel with IPSec encryption between two routers, but I keep getting error message saying "%CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet..." Immediately I ...
6
votes
2answers
6k views

How to configure Cisco remote access IPSEC VPN between IOS Router and Android phone

I have a C891FW router with IOS 15.4 on which I'm trying to configure a remote access VPN for Android's native VPN client. I'm authenticating with RSA-Sig and XAUTH. The tunnel forms but I can't reach ...
1
vote
1answer
75 views

VoIP, IPsec configuration

I have a topology in GNS3 with an IPsec VPN tunnel between C1 and C2 (https://imgur.com/dnNkssU). In clients networks i am configured a CME and a Softphone. When i make a call the quality is very bad. ...
0
votes
1answer
793 views

Can both IPsec endpoint be configured as the initiator?

Then configuring an IPsec tunnel, I can usually set if the device should act as the initiator or the responder (or even both). However, what would happen if both endpoint are configured as the ...
3
votes
3answers
15k views

rec'd IPSEC packet has invalid spi

I have setup a lab to play with DMVPN and EIGRP. Everything works perfectly fine until I test things by shutting down redundant ports. Once I do that the DMVPNs never recover even after restoring all ...
3
votes
0answers
176 views

IPSec Tunnel not coming up: Issue with ACL?

I'm trying to bring up a IPsec tunnel between router and a bridge. I can see the Ipsec tunnel configurations are up and running but I think I have made a mistake in the ACL and hence the encr and decr ...
2
votes
1answer
350 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
3
votes
1answer
480 views

High Availability for ISR 4431 IPSec VPNs

I have the following lab setup in GNS3. R1 & R2 are VPN endpoint at my datacenters and R3 is simulating a remote site. What i'm trying to accomplish is having one tunnel from R3 to the ...
3
votes
1answer
533 views

Traffic not send in IPsec with a Cisco ASA

I try to set up a site to site IPsec between an Ericsson router and a Cisco ASA, as shown below: My tunnel is UP and R1 seems to be working fine. However, my ASA does not forward traffic between ...
3
votes
3answers
10k views

How to check if IPSec is available on Cisco ISR 4451

On a Cisco isr 4451 with base image I need to check if IPSec is available. Is there an command to list available vpn features? UPDATE The image name includes K9 (UNIVERSALK9-M) but the command failed ...
1
vote
1answer
514 views

IPSec route-based vpn st0 interface

As i know, the st0 interface is used when the gateways are configured with route based VPN. But my question is, say below is the topology A<---->B<---->C<---->D A and D are hosts, B and C ...
0
votes
1answer
45 views

What is the reason for encrypting Identity field under IPsec phase1?

Why Identity fields are encrypted in IPsec phase 1 around packet 5/6 ? provided that the Identity field contains IP of either end. Does it has any significance ? Does it holds anything different then ...
0
votes
0answers
108 views

ASA - communication between 2 tunnels

I have two IPSEC tunnels with an ASA in the middle Site A - 10.20.4.0 /24 (65.176.80.84) Site B - 192.168.142.0 /24 ASA - 10.99.206.0 /24 (95.12.22.33 Site A - 10.20.4.0 /24 can reach the ASA and ...
-2
votes
1answer
507 views

IPSec SA being Unidirectional

From what I’ve read, IKE SAs are Birectional and IPSec SAs are unidirectional. But if the same proposals are to be agreed by both the ends, say protocol esp, Authentication algorithm as hmac-sha1-...
0
votes
0answers
50 views

IPSec Tunnel is up but no Communication with End Systems?

I need help for IPSec tunnel. Currently, I am working on a small task to create remote access between my laptop and office router, in order to access the office LAN network. IPSec tunnel is working ...
1
vote
1answer
115 views

IPSec tunnel between 2 LANs using HSRP in each side

This is my first post here, so tell me if there's something I'm doing wrong. I'm currently working with another IT student on our end of degree project and we're building our network in PT. Our ...
4
votes
1answer
591 views

How IPsec tunnel mode work without GRE

IPsec tunnel mode encrypt a whole IP packet and sends it as the payload of another IP packet. I have always used GRE as the encapsulation layer when doing IPsec encryption. However, how could I have ...
0
votes
0answers
407 views

Query on Cisco IPsec Licensing, HSEC-K9

I'm currently debugging an issue with IPsec tunnels and it seems like one of our client's NW engineers didn't install the HSEC-K9 license. The issue is that the new IPsec tunnels are not coming up ...
1
vote
0answers
415 views

Why do the tunnel protocol on these two router show different values

Two routers R1 and R2 have a tunnel built between them in the 103.103.103.0/24 network. The end point of the tunnel are 75.75.75.2(on R1) and 76.76.76.2(on R2). Can anyone explain why does the Tunnel ...
1
vote
1answer
34 views

Can a VPN tunnel between routers be built with different tunnel protocol on both ends?

I have two routers and the tunnel between them is up and working well. Router1 has GRE/IP as the protocol on its tunnel interface, and as for Router2 the tunnel interface is working with IPSEC/IP. Can ...
3
votes
1answer
545 views

Azure VPN vs. Cisco ASA

I have a Cisco 5516-x with v9.7(1)21 on my end and I am trying to create a working VPN to Azure. It looks to me like phase1 goes well but phase2 fails due to policy mismatch. Any suggestions for how ...
3
votes
1answer
48 views

Why aren't we encrypting data on Network level instead of transport level when using e.g. HTTP [closed]

Why we are bothering to encrypt our data on a transport level, instead of just doing that on a network level with e.g. IPSec and get rid of the need to to that in upper layers. For example instead of ...
0
votes
1answer
177 views

Can I use the same IPsec tunnel for two VRF?

I have two routers linked by two logical links in two different VRF. I should move one router to another site and use Internet to keep the same connectivity. Since I use private IP addresses in my VRF,...
1
vote
2answers
405 views

AWS site-to-site VPN and multiple account VPC connections [closed]

I've configured a site-to-site VPN from our firewall (watchguard) to AWS. Now, how can I connect Account A with Account B? I've already an OpenVPN server in account A to which account B connects (...
0
votes
1answer
773 views

WatchGuard Mobile VPN with IPSec - “The VPN server did not respond”

I have been following official WatchGuard guide (mvpn_ipsec_ios_vpn_c.html) to set up Mobile VPN with IPSec on WatchGuard Firebox x750e v10.2.12. Inside the Policy manager, I can see this has been ...
4
votes
1answer
511 views

Use cases for GRE over IPSEC

I'm trying to understand use cases for GRE over IPSEC. In the diagram below, each site uses GRE to encapsulate multicasts associated with OSPF. (There is still a requirement to configure SAs between ...
4
votes
2answers
1k views

IKE phase 1 and phase 2

Was going through the IKE phase 1 and phase 2. I have some questions regarding the same which is bothering me with respect to main mode and quick mode.Please correct me if i go wrong somewhere. Phase ...
1
vote
0answers
338 views

AWS tunnel TCP retransmissions and DUP ACKs [closed]

I have a IPsec tunnel from my firewall towards AWS, the tunnel is up in both phases. If I run traffic sniffer in the firewall, I can see interesting traffic going through, but there are MANY TCP ...
1
vote
1answer
115 views

Shared secret key for Diffie-Hellman key exchange

From what i have learnt,in Asymmetric key there is public key and a private key. For instance: Step 1: Alice and Bob get public numbers P = 23, G = 9 Step 2: Alice selected a private key a = 4 and ...
1
vote
1answer
142 views

Outbound NAT for single host behind an ASA located over an IPSEC tunnel [closed]

I have these two nets connected over the public internet with ASA 5510s. 192.168.0.0 < -- ASA1 ---> Internet <--- ASA2 --> 192.168.5.0 Each net does either a simple dynamic or static nat ...
3
votes
1answer
5k views

IPsec Tunnel is showing decrypt packets counter but 0 encryption packets: #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

I have just configured the IPSEC tunnel between my router and the Access point.I could see that the Tunnel has came up and Active in both sides. However,When I checked the "Show cyrpto ipsec sa" ,I ...
1
vote
0answers
493 views

ipsec tunnel between Cisco IOS router and Perle IOLAN SCS 32

I cannot get a IPsec tunnel up and run between a Perle IOLAN SCS 32 with firmware 4.5 and Cisco ASR 1001 with IOS XE 15.3 - it fails in phase 2 with invalid proposals Has some out there a sample for ...