People who code: we want your input. Take the Survey

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
1
vote
1answer
598 views

ASA VPN Tunnel NAT Issues

I've been trying to jump through two tunnel. A Customer has a cloud solution which we need access to. Since we already have a vpn site2site tunnel to the customer we can already access his LAN. What ...
3
votes
1answer
2k views

L2TP IPSec Remote VPN - Many users connecting remotely from same access

Can someone explain to me, why isn't possible to connect 2 or more clients to a VPN server when the users are behind the same public IP (NAT/PAT). What I mean is: if there is already a user connected ...
2
votes
1answer
315 views

how security association (SA) is established?

I'm a newbie in networking, still struggling to understand some concepts. I was reading a text describes security association (SA) in VPN. Whenever router R1 needs to construct an IPsec datagram for ...
2
votes
2answers
4k views

IPSec in IPv4 and IPv6

I'm getting a little confused in understanding the differences in IPSec in IPv4 and IPv6... Are the principles of IPsec the same in v6, but instead of it being optional it is now mandatory for it to ...
2
votes
1answer
704 views

Junos IPSEC Tunnel to Azure & TCP-MSS

I am configuring a Juniper SRX 300 Series to establish an IPSEC tunnel to Azure. The Azure Vnet range is 192.168.10.0/23 The local range is 10.49.236.0/24. The configuration: (relevant bits with ...
1
vote
1answer
2k views

Result of running `restart ipsec-key-management`

I have Juniper SRX 1400 which is used mainly for IPSEC tunnels. And now I facing a bug in firmware with ID PR1085657 (IKE doesn't come up when the SRX is the initiator). Possible solutions to this is ...
2
votes
1answer
1k views

Site-to-site IPSEC for multiple peers with dynamic IP on Juniper SRX

Looking for possible solution. I have Juniper SRX 1400 (12.1X47-D20.7) with static WAN IP in data-center and multiple sites with dynamic WAN IP addresses. I need to build with them site-to-site VPN's....
2
votes
0answers
981 views

RSA key not working with trustpoint used for IPSec

I'am trying to setup an IPsec IKEv2 tunnel where the local authentication mechanism is based on RSA. Therefore I have setup a trustpoint and I got a signed certificate for this setup. Importing is ...
2
votes
1answer
272 views

Latency-sensitive channel bonding

One of our satellite offices is connected by a Satellite connection with no other high bandwidth option. Reliability is good and bandwidth is acceptable (50/10 MB/s), but latency is making, ssh, VPN ...
2
votes
2answers
1k views

GRE-IPsec Tunnel between Cisco Router and a Linux Router

I am trying to create a GRE/IPsec tunnel between Cisco router and a Linux Router. The tunnel is UP and active, but when I do a "show crypto session" on the Cisco router the Active SA's keep on ...
1
vote
1answer
751 views

DSCP trust over IPSec GRE

I have 2 branch offices connecting together via a metro-e and I'm running an ipsec gre tunnel between the 2 sites. routerA=branch1 routerB=branch2 WAN-------routerA----------|metroe|------------...
5
votes
1answer
9k views

IPSec failure with `IKE message failed its sanity check or is malformed`

I've been battling with my IPSec configuration for some days (with foolish deadline looming) and would like to ask for help with it failing its initial connection. It's designed as client-to-router ...
2
votes
0answers
38 views

encryption gateway vs domain and source ip issues [closed]

(This is the same setup as a previous question.) My VPN connection was no longer working (for ~4h), so I called the remote end's tech support. While we were talking, the link mysteriously started ...
3
votes
1answer
705 views

GRE over IPSec vs L2TP over IPSEC

Every single VPN provider offers L2TP over IPSec. What is the reason GRE over IPSec is never offered ? Is there any downfall ? It seems to be exactly the same.
0
votes
1answer
900 views

Configuring IPsec VPN and TTL

I have two sites, each using their own firewall. Once a Cisco Meraki, another a Cisco ASA. The two sites use IPsec to establish a VPN tunnel. The Question: If each of the two sites have different ...
0
votes
2answers
160 views

IPSec - NAT-T inner/outer IP of the gateway?

I was configuring an IPSec VPN and somehow I can't figure out what the inner/outer IP of my gateway would be. Have a look at this image : Imagine I have my site-to-site VPN, with my gateway having ...
-1
votes
3answers
898 views

Connecting to subnets with IPSec VPN, how to route?

I set up a site-to-site VPN between two TP-Link routers, following the instructions here: https://www.tp-link.com/ae/faq-380.html . The VPN is based on IPSec. Now both routers say that the IPSec ...
1
vote
1answer
352 views

ESI PBX LAN-only VoIP phone forwarding thru IPSec tunnel - remote router sees packets but not phone, doesn't forward

Okay, so we have an older X-Class ESI PBX system, an ESI IVX 128x FSIII [see below for link]. We have an LNC card installed in it, which allows for the use of up to 12 LAN-only VoIP phones. We have an ...
1
vote
1answer
823 views

Cisco VRF aware dynamic VTI based IPSEC VPN

im struggeling on a Cisco IPSEC Konfiguration. My aim is to terminate spoke sites behind CGN gateways into a MPLS L3VPN Network via IPSEC tunnels. The router at hub site is a ASR1k running IOS XE 3....
1
vote
1answer
501 views

SonicWall Site-to-site VPN with WAN IP endpoint

I'm not a real network engineer (just something I must dabble in from time to time), so hopefully I will provide enough detail and use the right terminology here. We have a site-to-site VPN ...
4
votes
1answer
5k views

Fortigate 30D IPSEC VPN could not locate phase1 configuration

Hello network engineers, I have an IPSEC VPN tunnel between two offices, the HQ is a fortigate 200B(os:v5.0,build0292 (GA Patch 9)) and the branch is fortigate 30D(os:5.2.3). Both are now on static ...
5
votes
2answers
876 views

Can I do a pure IPSec VPN (no L2TP) with NAT-T where the server is inside a NAT?

Topology: Client -> Client Router -> CLOUD <- Server Router <- Server 10.0.1.5 10.0.1.1 <-NAT-> 100.1.1.1 200.1.1.1 <-NAT-> 192....
2
votes
2answers
15k views

How are VPN Clients given IP addresses when they connect to VPN Routers such as VyOS? (How do Virtual IP Address Pools fit in?)

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network when they connect to the StrongSWAN or OpenVPN VPN Server that's embedded in VyOS ...
0
votes
2answers
828 views

setting up aws vpn with srx110

I'm trying to setup an IPsec vpn to AWS from an SRX 110 and am having some trouble getting it to work. I've download the config file and my tunnels seem to be up, but I can't seem to ping anything in ...
4
votes
1answer
107 views

Confused on perfect forward secrecy, someone kindly help me

i just read following article In IPsec VPN, how is the pre-shared key encrypted? got knowledge about phase 1 also basic line over PFS: for every new negotiation of Phase 2 SA the 2 gateways must ...
3
votes
3answers
563 views

Layer 3 tunnel with Dynamic IP address

I want to ask whether it is possible to configure Layer 3 Tunnel with the two end points/interfaces have dynamic IP address? If the interface IP change, the tunnel will have to be re-negotiated, is ...
1
vote
1answer
124 views

IPv6 VPNs source address selection

Say I have the following IPv6 prefix assigned to me by my ISP : 2a01:1000:1000::/48 with 2a01:1000:1000::1/48 assigned to my VPN server. I set up a VPN with a /64 from that block to assign to my ...
2
votes
1answer
2k views

Connecting to fortigate 5.4 with vpnc (ipsec)

I have a fortigate 90b(?) running 5.4. wan1 is set to a publically accessible address. Our internal network is 192.168.100.0 I can connect via ipsec and I can access the gateway, which is the ...
2
votes
1answer
3k views

SonicWall is dropping encrypted packets with error “sonicwall ipsec vpn decryption failed selector check error”

I have implemented a Site-to-Site IPsec tunnel between a Juniper SSG firewall and a SonicWall. However, any traffic that I send over the tunnel gets dropped on the SonicWall with an error saying ...
1
vote
2answers
7k views

Cisco ASA MTU vs TCP MSS

I am trying to set jumbo MTU for Cisco ASA 5585 and I did following: asa1/pri/act(config)# mtu inside 9000 INFO: Jumbo frames should be enabled to receive packets more than 1500 MTU Use '...
3
votes
1answer
388 views

ASA as a local DNS resolver

I have an site to site VPN access configured by ASAs. My remote site needs to connect to the domain through the tunnel which will required DNS located on the main site. I would like to use DNS server ...
2
votes
1answer
66 views

RV042G VPN network drive mapping and RDC

I'm trying to figure out if I can use the Cisco RV042G router for VPN access to our Windows domain (Server 2016). I would like to achieve the following: Logging on to the VPN from home workstations ...
1
vote
2answers
1k views

Cisco ASA-5505 - Can ping the Internet from LAN connected devices, however I cannot ping from the LAN interface to the Internet

I am new to Cisco ASA and ASDM. Struggling with difference from IOS devices. Network layout is as follows: AWS VPC -- IPsec tunnel -- ASA-5505 -- LAN Currently: IPsec tunnel is up. AWS can reach ...
1
vote
1answer
544 views

PBR not working as expected

EDITED: ADDED FULL ROUTER CONFIG I have a cisco 2921. It uses EIGRP to learn its routing table and has no static default routes set up. I would like to keep it that way. The default route (learned ...
1
vote
2answers
481 views

SIte-to-Site VPN between ASAv8 and ASAv9: NAT issue

I'm setting up a site-to-site via ASDM. Initially I configured both devices correctly, matching policies, crypto, etc and set both inside networks as "NAT exempt". Problem is, when I apply changes on ...
3
votes
1answer
15k views

ASA tunnel up but not passing traffic

I have two offices (Victoria at IP 1.2.3.4 and Toronto at IP 5.6.7.8) each with pfSense running Strongswan, and each with an IKEv2 IPSec tunnel back to a Cisco ASA 5512 at IP 9.8.7.6. I recently ...
1
vote
1answer
1k views

Cisco ASA DH group and Lifetime of Phase 2

Not very good with ASAs so please have that in mind. I need to replace an ASA but can't seem to get some info on Phase 1 and Phase 2. I can get everything from Phase 1 except the DH group (got PFS ...
2
votes
1answer
1k views

How to configure site to site VPN between Cisco ASA and Cisco router? [closed]

I have CISCO ASA on one site and CISCO ROUTER on other side, both have outside interface facing public IP and doing NAT for internal VLAN's. How to connect different VLAN's on one site to VLAN's on ...
1
vote
1answer
847 views

Cisco 5506-x dynamic site to site tunnel doesn't works

I am followed ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example step by step, currently I am using IP address 10.0.0.1 for the static peer and 10.0.0.2 for the dynamic peer, but seems ...
1
vote
2answers
354 views

Cisco IPSEC Tunnel with hidden local networks

I've got an ipsec tunnel that's up and working with ATT. They require that the phase 2 IP's not be local LAN's, but public IP's. So, my phase 1 is X.X.X.132, and my Phase 2 is on the same subnet as X....
1
vote
1answer
4k views

SSL VPN vs IPSec, pros and cons [closed]

What does an SSL VPN protect you from vs an IPSec VPN and what are the pros and cons to each?
2
votes
1answer
720 views

IPSec: Does it make sense to use conntrack state on ESP in an iptable rule? [closed]

Does it make sense to have an iptable rule as below? -A INPUT -p esp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT I could not find any documentation that would explain the meaning of "states" ...
3
votes
1answer
3k views

IPSec site-to-site with/without NAT

I am connecting my office to a client's network via IPSec. The need is for me to connect directly to internal IPs on their network; there is no need for them to connect to any services on my internal ...
1
vote
2answers
2k views

Multiple IPSEC tunnels between 2 Cisco Routers

I have a scenario where we need to establish multiple IPSEC tunnels between 2 devices. In the above scenario, ASR has multiple VRFs and we want to create IPSEC tunnel for each VRF and the other end ...
1
vote
1answer
1k views

Cisco IPSec Pass-through on ASA 5505 not working

I have been busting my brain for a few days not and I have so far not been able to figure out what the issue here is. The Problem: I am unable to establish a Client-to-ASA IPSec tunnel from behind ...
3
votes
5answers
10k views

Propagate VLAN through VPN (IPsec)?

I have a question about connecting two LANs (logically same LAN) over a VPN. In picture below you can see overall representation of our implementation. Description: On each side, we have distinct ...
1
vote
1answer
192 views

Secure communication between multiple sites over Internet

Does anyone know what would be the best practice to securely connect 2 or more branches with HQ over the Internet, and to allow communication between all of them (so anyone can contact anyone) if I ...
2
votes
1answer
3k views

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

We have following scenario, my side we have Cisco ASA and we have IPsec tunnel to Customer US-Datacenter and i can ping 172.16.0.0 subnet from my ASA (local LAN 10.0.0.0/8) but now i want to ping EU-...
2
votes
1answer
1k views

IPsec vpn missing crypto keyring

We have VPN tunnel with our customer and they sent their side VPN config and i am trying to put that config in my Cisco ASA 5585 (9.x) version and it has missing crypto keyring command Customer ...
1
vote
1answer
397 views

VPN Hardware Client with Split Tunneling (How do I design this?)

I want to implement a network design for my home office that has the capabilities of connecting to a VPN or Tunneling service and performs Split Tunneling within the network appliances. The reason ...