Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
3
votes
1answer
3k views

IPSec site-to-site with/without NAT

I am connecting my office to a client's network via IPSec. The need is for me to connect directly to internal IPs on their network; there is no need for them to connect to any services on my internal ...
2
votes
2answers
2k views

How to keep an ASA tunnel up for lifetime?

We have a Cisco ASA and at the remote end I have no idea what the device is. This is what happening: When I send a packet or generate interesting traffic, it brings up the tunnel and everything ...
2
votes
1answer
4k views

IPSec IKEv2 connection failure due to RSA authentication issue

I'm trying to get an IPSec/IKEv2 setup working, which was implement following this I don't understand why, but when a client connects (StrongSwan on Android here), the session is closed because the ...
1
vote
1answer
133 views

Secure communication between multiple sites over Internet

Does anyone know what would be the best practice to securely connect 2 or more branches with HQ over the Internet, and to allow communication between all of them (so anyone can contact anyone) if I ...
2
votes
2answers
12k views

How are VPN Clients given IP addresses when they connect to VPN Routers such as VyOS? (How do Virtual IP Address Pools fit in?)

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network when they connect to the StrongSWAN or OpenVPN VPN Server that's embedded in VyOS ...
2
votes
1answer
3k views

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

We have following scenario, my side we have Cisco ASA and we have IPsec tunnel to Customer US-Datacenter and i can ping 172.16.0.0 subnet from my ASA (local LAN 10.0.0.0/8) but now i want to ping EU-...
2
votes
1answer
1k views

IPsec vpn missing crypto keyring

We have VPN tunnel with our customer and they sent their side VPN config and i am trying to put that config in my Cisco ASA 5585 (9.x) version and it has missing crypto keyring command Customer ...
2
votes
1answer
1k views

How to configure site to site VPN between Cisco ASA and Cisco router? [closed]

I have CISCO ASA on one site and CISCO ROUTER on other side, both have outside interface facing public IP and doing NAT for internal VLAN's. How to connect different VLAN's on one site to VLAN's on ...
1
vote
1answer
380 views

VPN Hardware Client with Split Tunneling (How do I design this?)

I want to implement a network design for my home office that has the capabilities of connecting to a VPN or Tunneling service and performs Split Tunneling within the network appliances. The reason ...
2
votes
2answers
16k views

Cisco ASA: Unable to establish IPSec tunnel with IKEv2: Auth exchange failed

This is a Cisco ASA 5515-X with software 9.6(3)20. The remote side didn't tell me what they use, must be Strongswan or something. Using the following debug commands debug crypto ipsec 255 debug ...
2
votes
1answer
11k views

ASA IPsec Removing peer from correlator table failed, no match

We have two ASA 5585 and ASA 5506 and we're trying to setup an IPsec VPN tunnel between both ASA but getting this error [SITE-1]--------Internet------------[SITE-2] I'm getting this error in debug ...
2
votes
1answer
524 views

ISR <> ISR (IPSec VPN)

Trying to form IPsec between two ISR-4000s. There is Nexus in between to form eigrp in between. There is eigrp even spinning inside ISR's inside interface. (leaving it on for lab purposes for now). [...
1
vote
1answer
948 views

Cisco IPSec Pass-through on ASA 5505 not working

I have been busting my brain for a few days not and I have so far not been able to figure out what the issue here is. The Problem: I am unable to establish a Client-to-ASA IPSec tunnel from behind ...
0
votes
1answer
767 views

ISAKMP problem on F5 BIG-IP

I'm trying to move a site-to-site IPsec tunnel from a Cisco ASA 5505 and a BIG-IP LTM+AFM version 12.1.0. The tunnel was up and traffic flowed properly when the tunnel was terminated on ASA but not ...
3
votes
2answers
244 views

Why does IPSec in transport mode not guarantee integrity?

Wikipedia says: Unlike Authentication Header (AH), ESP in transport mode does not provide integrity and authentication for the entire IP packet. I don't understand why this would be true. What is ...
2
votes
0answers
2k views

IPsec IKEv2 with StrongSwan Cert+EAP not working

I'm trying to setup a Cisco router (881H) to act as a head end for an IPsec IKEv2 VPN. The target setup is meant to be used by StrongSWan clients (currently testing on Android smartphone), and we wish ...
2
votes
1answer
2k views

Cisco ASA single isakmp policy for multiple crypto map

We are going to setup multiple site-to-site tunnels to our remote office and every tunnel configuration is identical (same hash,encryption etc). The question is: Do I need to create a separate ...
2
votes
1answer
154 views

Traffic not seen as interesting over tunnel

I have an issue where traffic is no longer passing over the tunnel. Below is my config and I can not get access to the other side due to not being allowed. I just need to make sure my config is ...
0
votes
1answer
52 views

Authentication header doubt

In a book by Forouzan (https://www.amazon.com/Data-Communications-Networking-McGraw-Hill-Forouzan/dp/0072967757) I've read that the sequence number of the authentication header doesn't get repeated ...
0
votes
1answer
719 views

WatchGuard Mobile VPN with IPSec - “The VPN server did not respond”

I have been following official WatchGuard guide (mvpn_ipsec_ios_vpn_c.html) to set up Mobile VPN with IPSec on WatchGuard Firebox x750e v10.2.12. Inside the Policy manager, I can see this has been ...
3
votes
1answer
659 views

GRE over IPSec vs L2TP over IPSEC

Every single VPN provider offers L2TP over IPSec. What is the reason GRE over IPSec is never offered ? Is there any downfall ? It seems to be exactly the same.
2
votes
1answer
63 views

RV042G VPN network drive mapping and RDC

I'm trying to figure out if I can use the Cisco RV042G router for VPN access to our Windows domain (Server 2016). I would like to achieve the following: Logging on to the VPN from home workstations ...
1
vote
2answers
9k views

IPSec site to site VPN Fortigate

We have a site to site VPN connection to a branch office. Once in a while the connection drops for some reason and then we receive an error like this on the Fortigate 310b ike Negotiate ISAKMP SA ...
1
vote
1answer
518 views

Huawei AR160 IPSEC over DSL Packet Loss

we are Struggeling with some IPSEC Configuration via a DSL Line on a Huawei AR169 Router. When the Tunnel is running over an PPPoE Dialer we notice about 70% Packet Loss in the Tunnel. When the ...
2
votes
1answer
940 views

Different tunnel modes (protected with ipsec)

I’m doing a connection of 2 sites in ipv6 over an ipv4 network. I thought to do a tunnel between this 2 sites and protect it with IPsec. But I saw there are different types of tunnels (by default GRE):...
7
votes
4answers
6k views

How to make IPSEC over double NAT?

I need to have a site to site VPN between two sites. Here is the following topology for each site: Site A: One Cisco 1921 WAN port (192.168.3.2) connected to ISP router (192.168.3.66), both the ...
2
votes
2answers
2k views

BGP over IPsec: session flapping

We have two IPsec VPN tunnels (over the public network) to a VPC in AWS. Each tunnel has one BGP session. Our router is a Cisco 3925E. Under load (not necessarily excessive), the BGP sessions are ...
3
votes
3answers
8k views

How to check if IPSec is available on Cisco ISR 4451

On a Cisco isr 4451 with base image I need to check if IPSec is available. Is there an command to list available vpn features? UPDATE The image name includes K9 (UNIVERSALK9-M) but the command failed ...
2
votes
1answer
682 views

IPSec: Does it make sense to use conntrack state on ESP in an iptable rule? [closed]

Does it make sense to have an iptable rule as below? -A INPUT -p esp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT I could not find any documentation that would explain the meaning of "states" ...
2
votes
2answers
102 views

Cisco IPSec questions on loopback0 and phase 2

ip multicast-routing crypto isakmp policy 2 encr 3des hash md5 authentication pre-share crypto isakmp key 123 address 1.7.129.10 ! crypto ipsec transform-set remotevpn esp-3des esp-md5-hmac ! ...
2
votes
3answers
558 views

IPSec : Is it normal to see packet drops during SA re-keying?

In our environment we are noticing packet drops (with reason "No SA Found") during the SA re-keying. The traffic rate is about 1.2Gbps (pkt size: 800 bytes) and the packet drops are about 200-300 ...
1
vote
2answers
315 views

i want to pass the traffic vlan traffic through already established IPSec tunel

I have this setup configured where an IPSEC tunnel is established between 10.15.10.2(ROUTER) and 10.16.70.2(LINUX machine) . Now I want pass traffic through the same tunnel from two more diffrent ...
1
vote
3answers
8k views

NAT-T Traversal on a Cisco ASA

I'm trying to set up a IPSec VPN connection between a Cisco ASA and a Mikrotik router (which is behind a Fritzbox in DMZ mode). I think everything is set up correctly except for that NAT-T is missing ...
3
votes
1answer
288 views

How troubleshoot poor ipsec connection?

I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers ...
3
votes
1answer
823 views

Asymmetric routing issue

Please find the network diagram, We have MPLS and Internet connectivity in our some of spoke sites in Hub router running in IPSLA for failure purpose. Here MPLS is the primary and VPN is the ...
2
votes
1answer
602 views

Two way IPSec tunneling

I would like to implement two VPNs on the same interface of a router. The router in question is router A which has one public interface Fa0/0 with IP: 22.33.44.55 (ex). First IPSec tunnel is a LAN-...
2
votes
1answer
967 views

Why is IKE needed for IPSec VPN?

I am confused about the need of IKE Phase 1. As far as I understand, IKE uses 2 phases, first one is to exchange parameters, such as encryption, authentication method, hashing type and so on. It ...
1
vote
1answer
60 views

Managing many L2TP VPNs?

We currently use many IPSec VPNs to connect to separate companies, but the VPNs are managed by a third party. We are interested in running these VPNs ourselves, using any method as long as it is IPSec....
3
votes
1answer
2k views

L2tp/IPSEC vs pure IPSEC

So, I was reading about the L2TP protocol and I understand what it basically does. But I fail to see why it would be preferred over pure IPSEC(VPN). VPN already provides end-to-end encryption between ...
4
votes
1answer
286 views

Does any router support line-speed throughput for a single IPSec tunnel?

Has anyone achieved line-speed or close to line-speed throughput on a SINGLE IPSec tunnel on a 10Gbps port? If this is not possible, what would be a reasonable throughput (w.r.t interface speed) to ...
1
vote
2answers
641 views

ASA's traffic policy(QoS) for ipsec VPN tunnels

i have ipsec l2l VPN over internet, I wander if there is default policy in ASA for making ipsec traffic with higher priority? My question basically is, if one of packet from two packets must be ...
1
vote
2answers
127 views

CISCO IPsec site-to-site client configuration

I want to build a gns3 site-to-site IPsec VPN between two CISCO routers. My question is, do I have to configure the clients behind each router in a specific way so that they will be aware of the ...
2
votes
2answers
4k views

IPSec in IPv4 and IPv6

I'm getting a little confused in understanding the differences in IPSec in IPv4 and IPv6... Are the principles of IPsec the same in v6, but instead of it being optional it is now mandatory for it to ...
2
votes
1answer
2k views

Connecting to fortigate 5.4 with vpnc (ipsec)

I have a fortigate 90b(?) running 5.4. wan1 is set to a publically accessible address. Our internal network is 192.168.100.0 I can connect via ipsec and I can access the gateway, which is the ...
4
votes
3answers
4k views

ISAKMP packet captures

I need to confirm my understanding of IPSEC phase 1. As per my understanding in the capture below, the first 2 messages are agreeing on the parameters, the next 2 are key exchange the final 2 is ...
0
votes
2answers
803 views

setting up aws vpn with srx110

I'm trying to setup an IPsec vpn to AWS from an SRX 110 and am having some trouble getting it to work. I've download the config file and my tunnels seem to be up, but I can't seem to ping anything in ...
1
vote
2answers
1k views

Cisco ASA-5505 - Can ping the Internet from LAN connected devices, however I cannot ping from the LAN interface to the Internet

I am new to Cisco ASA and ASDM. Struggling with difference from IOS devices. Network layout is as follows: AWS VPC -- IPsec tunnel -- ASA-5505 -- LAN Currently: IPsec tunnel is up. AWS can reach ...
0
votes
1answer
375 views

IPSEC VPN - Failed identity certification renewal

I've site-to-site VPN connection between an ASA and multiple Cisco routers. The identity certificates need to be renewed from time to time at the CA site and I didn't have problem until now. I'm ...
1
vote
2answers
2k views

SRX Point-To-Site IPsec VPN Setup

I'm trying to setup an IPsec VPN tunnel between a Debian Jessie system running strongSwan and an SRX. The end goal is to use the Debian host as a reverse-proxy for hosts behind the SRX, which I assume ...
1
vote
1answer
499 views

Juniper Qualified Next Hop for Ipsec Tunnels

I've got one VPN with 2 links going from my SRX to AWS. Both tunnels are bound to an st0. interface with qualified-next-hop: route 192.168.0.0/23 { qualified-next-hop 169.251.233.29 { interface st0....