People who code: we want your input. Take the Survey

Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
2
votes
1answer
475 views

ipsec balancing with multihomed setup

I have a multihomed setup with two ISPs with similar bandwidth characteristics. I want to route my traffic to a remote site via ipsec, so that my local network traffic goes through the tunnel and ...
12
votes
1answer
15k views

Cisco ISR G2 encrypted bandwidth restriction?

I have been having complaints of a "slow connection" from several new remote sites. The sites are connected via an MPLS L3VPN service into Cisco 2921's, and we are using Cisco GET-VPN to encrypt ...
7
votes
3answers
4k views

Problem with remote access, fixed L2L and dynamic L2L IPSEC working together on ASA 5540 8.2

I have an issue with a mixture of remote access, L2L and dynamic L2L tunnels on an ASA5540 running 8.2 Here is a snip of the relevant config:- crypto dynamic-map outside-crypto-dynamic-map 10 match ...
1
vote
2answers
74 views

How to connect several private networks throug the Internet into one using IPsec or OpenVPN?

Is it possible to connect several networks into one? I have read articles about site to site configuration through IPsec. But I haven't seen any articles which explain if it possible to connect 3 or ...
1
vote
1answer
52 views

How to configure a distributed network for the replication? [closed]

I want to replicate data (music, video, photos, user's data) across different geographical networks. How to connect several networks into a single network to let nodes comunicate to each other? ...
1
vote
0answers
818 views

Quagga BGP failover

I'm using Quagga + BGP with Racoon IPSec to connect to AWS VPN tunnel. AWS provides 2 tunnels for redundancy. Everything is working with fine with Asymmetric routing in place. To test failover, I ...
2
votes
0answers
1k views

Openswan not updating the routing table [closed]

I have a couple problems that I'm trying to find solutions to. I have Openswan and ASA configure as a IPSec VPN tunnel and the connection is established and working, but with some little problems. The ...
1
vote
1answer
612 views

Understanding the PDU at router when using Tunneling

I am creating a scenario in Packet tracer where i have two routers, and i have established an IPsec tunnel between them using ESP protocol, as show below, I have changed the packet tracer mode to ...
3
votes
1answer
6k views

IPSec based VPN using Openswan - IP confusion [closed]

I am currently trying to route traffic from one Linux box (local VM for testing purposes) to my Linux (Debian) server with the intent to use NAT. I was told to use IPSec to get my data to said server ...
2
votes
1answer
76 views

IPsec tunnel with IPv6 and security gateways

Silvia Hagen wrote in one of her books (ISBN:9783952294222, page 463) the following (free translation from german): Tunneling, an essential element of IPsec [...], is problematic for existing ...
1
vote
1answer
83 views

MTU when creating IPSec Packets

I'm trying to understand the MTU management when creating IPSec packets. If a IP packets already has the MTU, the resulting IPSec packet will be too large for the outbound link. Is there a IPSec ...
2
votes
1answer
922 views

Which layer does IPSec work

Does IPSec work below or above the network(IP) layer? If below then how does a router read the destination IP address which is encrypted inside the IPSec encryption?
1
vote
2answers
12k views

How to identify IPsec phase 2 on particular phase 1

I want to find out which phase 2 is associated with a particular phase 1 on cisco ASA device. There are several phase 1 and phase 2 on the device. With the following commands, I can see the active ...
2
votes
2answers
968 views

Packet flow in GRE Tunnel

In the below image what would be the ip address in the outer ip header when packet goes from R1 to R2. If the ip address in the outer header is 172.16.0.1 , how does it travels the internet as its not ...
2
votes
1answer
5k views

Fortigate “remembers” bad routes

I'm fairly new to Fortinet devices, so please let me know if I'm making a rookie mistake. I have a FortiGate 90D (v5.2.5,build701) which has an IPSec site-to-site VPN connection to another firewall ...
1
vote
0answers
70 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
1
vote
0answers
911 views

Connection problem, site-to-site, VYOS

I'm having problem with a site-to-site. I think I have the basic setup working and I want to confirm that the tunnel is up and working. Here is what I have: vyos@<vpnxy>:~$ show vpn ipsec sa ...
5
votes
2answers
17k views

Cisco ASA 5506-X - Site-to-Site VPN Tunnel - Return traffic dropped

I've configured a Cisco ASA 5506-X for a customer of mine and I'm having trouble successfully passing traffic round-trip to the remote network. The VPN tunnel connects successfully according to 'show ...
1
vote
1answer
8k views

IPSec Site-to-site VPN between Cisco ASA 9.0 and StrongSwan 4.4

The problem is the ikeV2 authentication with the ASA as initiator. For the following experimets I set on the ASA the followings PSKs: local: 123, remote: 321 In case the ASA is the initiator: Now ...
2
votes
2answers
3k views

High number of “pkts replay failed” on Cisco ASA

We are investigating some Communications issues between two sites connected via IPSec Tunnel running Cisco ASA on one side and Microtik on the other. On the Cisco ASA we are seeing an alarmingly high ...
3
votes
1answer
6k views

Pre-fragmentation for IPsec VPNs on cisco routers

I spent some time on this topic, but a lot of things is still unclear to me. Basically I don't understand how the pre-fragmentation is supposed to be configured on modern IOS boxes (does it have to be ...
1
vote
0answers
498 views

Unable to receive return packets on Azure IPSEC VPN Connection

Trying to get the VPN tunnel to Azure working on a Cisco ISR 1941 but have been unable to get any traffic flowing back from Azure to site. The tunnel looks to be up and a machine in Azure is ...
4
votes
0answers
512 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
4
votes
2answers
4k views

Why do multi-line crypto ACL's create instability in VPN tunnels?

Why does using multiple sets of specific ip's to specific ip's in a crypto ACL - cause instability in VPN tunnels, please relate this to phase 2 SA's (IPSEC). Ex. 172.16.0.0 -> 10.0.0.0 172.17.0....
3
votes
1answer
7k views

L2TP over IPSEC with a LAN to LAN link

I'm looking to add security on a LAN to LAN link that we have in my network. This LAN to LAN link is used to extend vlans over 2 sites (local & remote). For now, the diagram is this one : I ...
3
votes
1answer
2k views

Site-to-Site IPsec VPN Tunnel - Certain Traffic Doesn't Work [closed]

I've been having some strange issues with some site-to-site IPsec tunnels using ESP and pre-shared keys that I've been working on for the past two weeks with no success. The tunnel has no problem ...
1
vote
0answers
422 views

Change RADIUS auth method for remote access ipsec vpn

We have a Cisco 3825 router with an IPSec Remote Access VPN configured to authenticate against a radius server. We're retiring the old server and moving to a new one (Windows Server 2012). We changed ...
2
votes
0answers
1k views

IPSEC VPN between Cisco IOS and Checkpoint SA failure, one way works [closed]

I am trying to hook up a VPN between us and a customer. Customer has a Checkpoint FW (not sure which version), I have a 2811. Symptom: The tunnel (session) comes up, I can ping through, other side ...
1
vote
3answers
391 views

All tunnels down on Cisco 7204VXR with debug message “Unable to generate DH phase 2 parameters!”

I have 40 or 50 tunnels with over 200 SAs active on a 7204VXR with NPE-G1 using the software crypto engine (no VAS card installed). The working config was transferred over from a 2821 with AIM-VPN ...
4
votes
3answers
6k views

How does one configure Cisco router for IPSec VPN for use with Windows 7 built in VPN client?

Actually, I would like to allow users to use either the 64-bit Cisco VPN client or the Windows 7 built in client. Is this possible? Additional information: The IOS host is the 881w-A-K9 ISR running ...
1
vote
0answers
70 views

Issue with voice performance between two ip phones at the same site connecting to two different CUCM?

I have one branch which is (branch-1) with two groups of ip phones, one group is connecting to CUCM-1 in HQ and the other group is connecting to CUCM-2 in the branch (branch-1) and the connectivity ...
1
vote
1answer
2k views

Fortinet 60D acting as IPSec VPN Client?

Is there a way to make the Fortigate 60D act as a VPN client connecting to an ASA IPSec VPN without setting up a site-to-site VPN? In other words, have the Fortinet act as a typical PC would ...
10
votes
1answer
524 views

Dynamic Crypto Map with IPv6 access list

I am trying to configure a dynamic crypto map for use on a pure IPv6 network, on Cisco 15.2M. The problem is when I try to add an ipv6 access list to the dynamic crypto map, I get an error message. ...
0
votes
1answer
82 views

Can I configure IPSec on any Cisco Firewall?

I have done some search and I found that there is two series of cisco firewalls : Cisco ASA 5500 series and Cisco PIX 500 series firewalls. Do all Cisco Firewalls support IPSec configuration? ...
1
vote
1answer
144 views

Will an asa pass traffic that matches a crypto map entry if Phase 2 is not completed?

I have two ASAs that have publicly routable ipv6 addresses, and a /56 at each site. Since we're going to be rolling out ipv6 internally at some point for all users, I'd really like to prevent packets ...
3
votes
2answers
142 views

Protect traffic originated in remote Cisco ASA

(newbie Cisco here) I have an IPSEC vpn site to site tunnel between two ASAs. I have a set of networks in each location protected by the VPN tunnel. So far, so good. I would like to also protect ...
4
votes
1answer
21k views

Sonicwall not fowarding VPN traffic over tunnel

My office network is 10.25.0.0/16. I have a VPC in Amazon that's 10.100.0.0/16, and I have a VPN established between the office and the VPC using Amazon's Virtual Private gateway. This connection ...
0
votes
2answers
1k views

AWS hardware VPN access support [closed]

I am looking to do the following setup found here but I want to make sure the hardware I am looking to purchase will be compatible. The requirements of the hardware are listed here and the device I am ...
2
votes
2answers
2k views

Change default route only for IPSEC packets

I'm having some difficulty with this scenario. I have an "Internet Edge" whereby all of my regular traffic is firewalled, NATed and sent on it's way. I also have a "Wan Aggregation" layer where a ...
4
votes
2answers
3k views

Juniper SRX blank proxy-identity

I would really appreciate some clarification in the following matter. What I'm seeing I'm looking at two different SRX210 firewalls and specifically at their ipsec stanza. I'm seeing the following ...
3
votes
2answers
544 views

Cisco ASA - terminate more than 5000 IPSec VPN connections

We have a project where we need to terminate a large number of IPSec VPN peers. At the moment we are using Cisco ASA 5555-X appliances with VPN Premium license. We terminate at the moment about 2000 ...
1
vote
0answers
5k views

VPN tunnel connection issue

My company has 2 ASA firewall with model 5510 & 5512 in difference country, I was connected it via IPSEC VPN. It can work in normal until 2 weeks ago. I checked from log in ASA5512 firewall, it ...
0
votes
1answer
143 views

SSL VPN Security

I'm currently building a virtual private cloud on AWS EC2 using CentOS and am considering allowing access to the cloud via an SSL VPN server. I've never seen a company that uses an SSL VPN, however; I'...
3
votes
2answers
6k views

Route-based ipsec between cisco router end juniper srx

network experts! Help, please, to understand why there is no ping from source address to destination address over ipsec vpn(here, route-based). I have such schema: Phase1 and Phase2 of IPSec are up....
6
votes
1answer
1k views

After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel

After upgrading our ASAs from 9.1(1) to newer versions, users were no longer able to connect using native IPsec VPN client software when inside of an office network. From outside networks it still ...
4
votes
1answer
9k views

ASA VPN works as responder but not as initiator

I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.) When the pfSense starts the connection, everything works fine. When the ...
2
votes
1answer
303 views

ipsec vpn with preshared key p

I understood that three session keys are generated by diffi-helmen and nonces, in phase 1 msg 3 and msg 4 both exchanged diffi-helmen public key and generate shared secret key ,and shared secret key ...
13
votes
1answer
49k views

Getting Cisco ISAKMP and IPSec SA lifetime confused

I always get confused about security association lifetime configuration on Cisco IOS. On most web-managed hardware it is clear which SA lifetime is for Phase I and which is for Phase II. On Cisco ...
1
vote
1answer
676 views

Routing from IPSec VPN1 to IPSec VPN2 through HQ

I have a few remote offices running Cisco 800 Routers and a HQ that is running a Fortigate 80D and an Azure Cloud enviroment that has a VPN Tunnel to the Fortigate. Now, I have setup IPSec VPN's ...
2
votes
2answers
196 views

Cisco ASA 5520 - Create local VPN pool

Can I create a local ip pool with a /22 mask to support 1022 VPN hosts on an ASA or limited to a /24 mask per subnet