People who code: we want your input. Take the Survey

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
2
votes
1answer
13k views

ASA IPsec Removing peer from correlator table failed, no match

We have two ASA 5585 and ASA 5506 and we're trying to setup an IPsec VPN tunnel between both ASA but getting this error [SITE-1]--------Internet------------[SITE-2] I'm getting this error in debug ...
1
vote
3answers
8k views

NAT-T Traversal on a Cisco ASA

I'm trying to set up a IPSec VPN connection between a Cisco ASA and a Mikrotik router (which is behind a Fritzbox in DMZ mode). I think everything is set up correctly except for that NAT-T is missing ...
2
votes
3answers
5k views

GRE over IPsec between Juniper SRX100 and Fortigate 100D

I need assistance configuring VPN setup between Fortigate and Juniper devices (GRE over IPSec). I have the topology as follows: What I need to do is create a route-based IPSec tunnel between the ...
2
votes
1answer
532 views

ISR <> ISR (IPSec VPN)

Trying to form IPsec between two ISR-4000s. There is Nexus in between to form eigrp in between. There is eigrp even spinning inside ISR's inside interface. (leaving it on for lab purposes for now). [...
2
votes
1answer
160 views

Traffic not seen as interesting over tunnel

I have an issue where traffic is no longer passing over the tunnel. Below is my config and I can not get access to the other side due to not being allowed. I just need to make sure my config is ...
0
votes
1answer
799 views

ISAKMP problem on F5 BIG-IP

I'm trying to move a site-to-site IPsec tunnel from a Cisco ASA 5505 and a BIG-IP LTM+AFM version 12.1.0. The tunnel was up and traffic flowed properly when the tunnel was terminated on ASA but not ...
3
votes
2answers
1k views

Juniper to Cisco IPSec Policy Based VPN

I'm trying to setup a Site-to-Site VPN between a Cisco device and a Juniper SSG device. I have the Juniper setup in L3 mode with routed interfaces. For some reason it is not getting past phase 1. I ...
3
votes
2answers
282 views

Why does IPSec in transport mode not guarantee integrity?

Wikipedia says: Unlike Authentication Header (AH), ESP in transport mode does not provide integrity and authentication for the entire IP packet. I don't understand why this would be true. What is ...
2
votes
0answers
2k views

IPsec IKEv2 with StrongSwan Cert+EAP not working

I'm trying to setup a Cisco router (881H) to act as a head end for an IPsec IKEv2 VPN. The target setup is meant to be used by StrongSWan clients (currently testing on Android smartphone), and we wish ...
4
votes
2answers
5k views

Cisco IPSec VPN is not working

I'm trying to establish an IPSec VPN connection between my site and an ISP. I have a Cisco 1941 router and a Cisco firewall on the ISP side. I set up the configuration according to what the ISP has ...
3
votes
0answers
2k views

Multiple IPSec Tunnels on Cisco router's interface

I an trying to configure 2 IPSEC VPSN Tunnels on the Cisco 1941 WAN Port. The tunnel with the higher crypto map sequence pre-empts the lower sequence number so only one tunnel is active at a time. I ...
2
votes
1answer
3k views

Cisco ASA single isakmp policy for multiple crypto map

We are going to setup multiple site-to-site tunnels to our remote office and every tunnel configuration is identical (same hash,encryption etc). The question is: Do I need to create a separate ...
3
votes
3answers
354 views

Ipsec site to site Vpn

I need to communicate for three sites through vpn. For below scenario, is possible to reach 10.33.209.xx/27 from 192.168.60.xx. please give any idea to communicate in three segment.
1
vote
1answer
561 views

Huawei AR160 IPSEC over DSL Packet Loss

we are Struggeling with some IPSEC Configuration via a DSL Line on a Huawei AR169 Router. When the Tunnel is running over an PPPoE Dialer we notice about 70% Packet Loss in the Tunnel. When the ...
0
votes
1answer
52 views

Authentication header doubt

In a book by Forouzan (https://www.amazon.com/Data-Communications-Networking-McGraw-Hill-Forouzan/dp/0072967757) I've read that the sequence number of the authentication header doesn't get repeated ...
10
votes
2answers
422 views

Will ASA 5540 support 3000 simultaneous IPsec connections?

As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 ...
7
votes
4answers
7k views

How to make IPSEC over double NAT?

I need to have a site to site VPN between two sites. Here is the following topology for each site: Site A: One Cisco 1921 WAN port (192.168.3.2) connected to ISP router (192.168.3.66), both the ...
2
votes
2answers
106 views

Cisco IPSec questions on loopback0 and phase 2

ip multicast-routing crypto isakmp policy 2 encr 3des hash md5 authentication pre-share crypto isakmp key 123 address 1.7.129.10 ! crypto ipsec transform-set remotevpn esp-3des esp-md5-hmac ! ...
2
votes
1answer
3k views

OpenSWAN IPSec Connection to Cisco Meraki MX appliance [closed]

I have service I need to make VPN connections to. I have this working perfectly fine in windows, setup was quick, easy and straightforward. I am now trying to achieve the same connection in Linux ...
11
votes
2answers
14k views

In IPsec VPN, how is the pre-shared key encrypted?

I was doing IPsec VPN on ASA 8.0, and I understand a little about that. The initiator starts by sending its ISAKMP policy to the responder, and the responder sends back the matched policy. After that, ...
2
votes
1answer
952 views

Different tunnel modes (protected with ipsec)

I’m doing a connection of 2 sites in ipv6 over an ipv4 network. I thought to do a tunnel between this 2 sites and protect it with IPsec. But I saw there are different types of tunnels (by default GRE):...
2
votes
1answer
667 views

Two way IPSec tunneling

I would like to implement two VPNs on the same interface of a router. The router in question is router A which has one public interface Fa0/0 with IP: 22.33.44.55 (ex). First IPSec tunnel is a LAN-...
2
votes
2answers
2k views

BGP over IPsec: session flapping

We have two IPsec VPN tunnels (over the public network) to a VPC in AWS. Each tunnel has one BGP session. Our router is a Cisco 3925E. Under load (not necessarily excessive), the BGP sessions are ...
3
votes
1answer
291 views

How troubleshoot poor ipsec connection?

I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers ...
2
votes
3answers
730 views

IPSec : Is it normal to see packet drops during SA re-keying?

In our environment we are noticing packet drops (with reason "No SA Found") during the SA re-keying. The traffic rate is about 1.2Gbps (pkt size: 800 bytes) and the packet drops are about 200-300 ...
4
votes
2answers
393 views

IPsec tunnel configuration question

I have a network that is comprised of a main office and multiple branch offices. The main office houses the servers and each branch office has an IPsec tunnel to the main office. There are no ...
1
vote
2answers
411 views

i want to pass the traffic vlan traffic through already established IPSec tunel

I have this setup configured where an IPSEC tunnel is established between 10.15.10.2(ROUTER) and 10.16.70.2(LINUX machine) . Now I want pass traffic through the same tunnel from two more diffrent ...
3
votes
1answer
889 views

Asymmetric routing issue

Please find the network diagram, We have MPLS and Internet connectivity in our some of spoke sites in Hub router running in IPSLA for failure purpose. Here MPLS is the primary and VPN is the ...
2
votes
1answer
1k views

Why is IKE needed for IPSec VPN?

I am confused about the need of IKE Phase 1. As far as I understand, IKE uses 2 phases, first one is to exchange parameters, such as encryption, authentication method, hashing type and so on. It ...
1
vote
1answer
62 views

Managing many L2TP VPNs?

We currently use many IPSec VPNs to connect to separate companies, but the VPNs are managed by a third party. We are interested in running these VPNs ourselves, using any method as long as it is IPSec....
3
votes
1answer
2k views

L2tp/IPSEC vs pure IPSEC

So, I was reading about the L2TP protocol and I understand what it basically does. But I fail to see why it would be preferred over pure IPSEC(VPN). VPN already provides end-to-end encryption between ...
4
votes
1answer
306 views

Does any router support line-speed throughput for a single IPSec tunnel?

Has anyone achieved line-speed or close to line-speed throughput on a SINGLE IPSec tunnel on a 10Gbps port? If this is not possible, what would be a reasonable throughput (w.r.t interface speed) to ...
1
vote
2answers
678 views

ASA's traffic policy(QoS) for ipsec VPN tunnels

i have ipsec l2l VPN over internet, I wander if there is default policy in ASA for making ipsec traffic with higher priority? My question basically is, if one of packet from two packets must be ...
2
votes
0answers
1k views

High count of packet retransmissions/Dups over IPSEC/VPN [closed]

I'm running IPSEC-VPN (AES256/SHA256/DH14) tunnel between a PaloAlto PA-500 and a Fortigate 110C via Internet (10MBit up/down guaranteed both sides - latency between 40 and 50ms). 90% connections are ...
1
vote
1answer
526 views

Juniper Qualified Next Hop for Ipsec Tunnels

I've got one VPN with 2 links going from my SRX to AWS. Both tunnels are bound to an st0. interface with qualified-next-hop: route 192.168.0.0/23 { qualified-next-hop 169.251.233.29 { interface st0....
1
vote
2answers
132 views

CISCO IPsec site-to-site client configuration

I want to build a gns3 site-to-site IPsec VPN between two CISCO routers. My question is, do I have to configure the clients behind each router in a specific way so that they will be aware of the ...
2
votes
1answer
2k views

ASA to non-ASA Site-to-site VPN - Tunnel not staying up

I have a site-to-site tunnel up between two locations (non-ASA initiator, ASA responder). The tunnel will come up but not stay up. I'm 95% sure I have an issue in my crypto maps but I'm at a loss. The ...
4
votes
3answers
4k views

ISAKMP packet captures

I need to confirm my understanding of IPSEC phase 1. As per my understanding in the capture below, the first 2 messages are agreeing on the parameters, the next 2 are key exchange the final 2 is ...
1
vote
1answer
182 views

How do I generate ESP trafic (IPv6)?

I have this topology: I only have moon and sun. After the connection was successfully established, I need to generate ESP packets for wireshark capture. How do I generate ESP packets? When I use ...
31
votes
8answers
34k views

What are the downsides of OpenVPN?

I have been seeing so many people always wrestling with IPSec, and many other secure VPN technologies. I, for one, have always simply used OpenVPN, with beautiful and simple and versatile results. I'...
0
votes
1answer
409 views

IPSEC VPN - Failed identity certification renewal

I've site-to-site VPN connection between an ASA and multiple Cisco routers. The identity certificates need to be renewed from time to time at the CA site and I didn't have problem until now. I'm ...
1
vote
2answers
2k views

SRX Point-To-Site IPsec VPN Setup

I'm trying to setup an IPsec VPN tunnel between a Debian Jessie system running strongSwan and an SRX. The end goal is to use the Debian host as a reverse-proxy for hosts behind the SRX, which I assume ...
2
votes
2answers
13k views

debug crypto ipsec via ssh

How to debug IP Sec VPN on ASA using SSH? I try debug crypto ipsec terminal monitor logging monitor it asks for completion if i choose debug, all debug info are flooded. How do i view just IPSEC ...
2
votes
2answers
4k views

Cisco ASAv not building up child SA

Background information I have a Cisco 2911 router and a Cisco ASAv connected using a IKEv2 based IPSec tunnel. The tunnel initially comes up fine as soon as there is some traffic from the routers end....
2
votes
1answer
4k views

Cisco ASA Dead Peer Detection - Adjustments

I have L2L tunnels, some on marginal circuits, that frequently go down with a message like: %ASA-3-713123: Group = 50.x.x.x, IP = 50.x.x.x, IKE lost contact with remote peer, deleting connection (...
1
vote
1answer
165 views

IPsec device downstream from router/dhcp server

Looking to implement a pfSense SG-2440 downstream from the primary router so that we can (road warrior) VPN in. I know that I'll have to forward ports 500, 50, and 51 to the pfSense device from the ...
1
vote
2answers
42 views

IPsec packet path with tunnels

Could you tell me if my assumptions are correct and what happens in the last scenario? Say I am trying to ping an 192.168.x.x. address: Scenario 1: If my local network is 192.168.x.x, then IPsec ...
3
votes
1answer
531 views

FQDN DMVPN ISAKMP established IPsec fails negotiation

Trying to learn and play around with VPNs, similar setup worked fine in my home lab, PAT seems to be causing problems and I know it's config related, just not sure where. Connection is over an ISP ...
5
votes
1answer
1k views

Deploying an IPSEC secure-channel - isakmp SA empty

I am currently trying to encrypt traffic in an IPSEC tunnel with a simple lab architecture. The architecture looks like this : I am trying to mount an IPSEC tunnel between Router A & Router B, ...
1
vote
2answers
306 views

What is VPN? How is it different from SSH? [closed]

I read wikipedia page ;but it says that we can extend over private resources publically. and user can send - receive data using public network to remote resources in perspective that it is connected ...