Questions tagged [ipsec]

Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically.

Filter by
Sorted by
Tagged with
1
vote
1answer
333 views

ESI PBX LAN-only VoIP phone forwarding thru IPSec tunnel - remote router sees packets but not phone, doesn't forward

Okay, so we have an older X-Class ESI PBX system, an ESI IVX 128x FSIII [see below for link]. We have an LNC card installed in it, which allows for the use of up to 12 LAN-only VoIP phones. We have an ...
1
vote
1answer
171 views

How do I generate ESP trafic (IPv6)?

I have this topology: I only have moon and sun. After the connection was successfully established, I need to generate ESP packets for wireshark capture. How do I generate ESP packets? When I use ...
2
votes
2answers
12k views

debug crypto ipsec via ssh

How to debug IP Sec VPN on ASA using SSH? I try debug crypto ipsec terminal monitor logging monitor it asks for completion if i choose debug, all debug info are flooded. How do i view just IPSEC ...
3
votes
1answer
14k views

ASA tunnel up but not passing traffic

I have two offices (Victoria at IP 1.2.3.4 and Toronto at IP 5.6.7.8) each with pfSense running Strongswan, and each with an IKEv2 IPSec tunnel back to a Cisco ASA 5512 at IP 9.8.7.6. I recently ...
1
vote
2answers
1k views

Multiple IPSEC tunnels between 2 Cisco Routers

I have a scenario where we need to establish multiple IPSEC tunnels between 2 devices. In the above scenario, ASR has multiple VRFs and we want to create IPSEC tunnel for each VRF and the other end ...
2
votes
1answer
4k views

Cisco ASA Dead Peer Detection - Adjustments

I have L2L tunnels, some on marginal circuits, that frequently go down with a message like: %ASA-3-713123: Group = 50.x.x.x, IP = 50.x.x.x, IKE lost contact with remote peer, deleting connection (...
1
vote
1answer
4k views

SSL VPN vs IPSec, pros and cons [closed]

What does an SSL VPN protect you from vs an IPSec VPN and what are the pros and cons to each?
1
vote
2answers
39 views

IPsec packet path with tunnels

Could you tell me if my assumptions are correct and what happens in the last scenario? Say I am trying to ping an 192.168.x.x. address: Scenario 1: If my local network is 192.168.x.x, then IPsec ...
2
votes
2answers
3k views

Cisco ASAv not building up child SA

Background information I have a Cisco 2911 router and a Cisco ASAv connected using a IKEv2 based IPSec tunnel. The tunnel initially comes up fine as soon as there is some traffic from the routers end....
3
votes
1answer
700 views

Ping unlocks ipsec vpn

I have a ipsec vpn with a foreign company, this connects my network with their network and they have a different ip subnet. Ipsec is made by a pfsense gateway/firewall. I'm sure it is well configured,...
1
vote
2answers
298 views

What is VPN? How is it different from SSH? [closed]

I read wikipedia page ;but it says that we can extend over private resources publically. and user can send - receive data using public network to remote resources in perspective that it is connected ...
2
votes
1answer
464 views

ipsec balancing with multihomed setup

I have a multihomed setup with two ISPs with similar bandwidth characteristics. I want to route my traffic to a remote site via ipsec, so that my local network traffic goes through the tunnel and ...
1
vote
2answers
72 views

How to connect several private networks throug the Internet into one using IPsec or OpenVPN?

Is it possible to connect several networks into one? I have read articles about site to site configuration through IPsec. But I haven't seen any articles which explain if it possible to connect 3 or ...
1
vote
1answer
49 views

How to configure a distributed network for the replication? [closed]

I want to replicate data (music, video, photos, user's data) across different geographical networks. How to connect several networks into a single network to let nodes comunicate to each other? ...
1
vote
0answers
787 views

Quagga BGP failover

I'm using Quagga + BGP with Racoon IPSec to connect to AWS VPN tunnel. AWS provides 2 tunnels for redundancy. Everything is working with fine with Asymmetric routing in place. To test failover, I ...
1
vote
1answer
155 views

IPsec device downstream from router/dhcp server

Looking to implement a pfSense SG-2440 downstream from the primary router so that we can (road warrior) VPN in. I know that I'll have to forward ports 500, 50, and 51 to the pfSense device from the ...
1
vote
1answer
519 views

Understanding the PDU at router when using Tunneling

I am creating a scenario in Packet tracer where i have two routers, and i have established an IPsec tunnel between them using ESP protocol, as show below, I have changed the packet tracer mode to ...
5
votes
2answers
767 views

Can I do a pure IPSec VPN (no L2TP) with NAT-T where the server is inside a NAT?

Topology: Client -> Client Router -> CLOUD <- Server Router <- Server 10.0.1.5 10.0.1.1 <-NAT-> 100.1.1.1 200.1.1.1 <-NAT-> 192....
3
votes
1answer
517 views

FQDN DMVPN ISAKMP established IPsec fails negotiation

Trying to learn and play around with VPNs, similar setup worked fine in my home lab, PAT seems to be causing problems and I know it's config related, just not sure where. Connection is over an ISP ...
2
votes
1answer
864 views

Which layer does IPSec work

Does IPSec work below or above the network(IP) layer? If below then how does a router read the destination IP address which is encrypted inside the IPSec encryption?
1
vote
1answer
79 views

MTU when creating IPSec Packets

I'm trying to understand the MTU management when creating IPSec packets. If a IP packets already has the MTU, the resulting IPSec packet will be too large for the outbound link. Is there a IPSec ...
2
votes
3answers
5k views

GRE over IPsec between Juniper SRX100 and Fortigate 100D

I need assistance configuring VPN setup between Fortigate and Juniper devices (GRE over IPSec). I have the topology as follows: What I need to do is create a route-based IPSec tunnel between the ...
1
vote
2answers
11k views

How to identify IPsec phase 2 on particular phase 1

I want to find out which phase 2 is associated with a particular phase 1 on cisco ASA device. There are several phase 1 and phase 2 on the device. With the following commands, I can see the active ...
1
vote
0answers
70 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
2
votes
2answers
912 views

Packet flow in GRE Tunnel

In the below image what would be the ip address in the outer ip header when packet goes from R1 to R2. If the ip address in the outer header is 172.16.0.1 , how does it travels the internet as its not ...
2
votes
2answers
3k views

High number of “pkts replay failed” on Cisco ASA

We are investigating some Communications issues between two sites connected via IPSec Tunnel running Cisco ASA on one side and Microtik on the other. On the Cisco ASA we are seeing an alarmingly high ...
3
votes
3answers
350 views

Ipsec site to site Vpn

I need to communicate for three sites through vpn. For below scenario, is possible to reach 10.33.209.xx/27 from 192.168.60.xx. please give any idea to communicate in three segment.
1
vote
0answers
495 views

Unable to receive return packets on Azure IPSEC VPN Connection

Trying to get the VPN tunnel to Azure working on a Cisco ISR 1941 but have been unable to get any traffic flowing back from Azure to site. The tunnel looks to be up and a machine in Azure is ...
2
votes
1answer
5k views

Fortigate “remembers” bad routes

I'm fairly new to Fortinet devices, so please let me know if I'm making a rookie mistake. I have a FortiGate 90D (v5.2.5,build701) which has an IPSec site-to-site VPN connection to another firewall ...
4
votes
0answers
487 views

Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached

I am working on implementing a "standard" Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message: %ASA-4-713239: IP_Address: Tunnel Rejected: ...
2
votes
1answer
2k views

Cisco ipsec tunnel with nat to aws customer gateway

I'm trying to configure an IPSec tunnel between a Cisco router (ISR) and AWS (Customer Gateway). The connection to the ISP here is a PPPoE connection with a static private IP (e.g. 10.100.1.1) which ...
3
votes
1answer
6k views

IPSec based VPN using Openswan - IP confusion [closed]

I am currently trying to route traffic from one Linux box (local VM for testing purposes) to my Linux (Debian) server with the intent to use NAT. I was told to use IPSec to get my data to said server ...
2
votes
1answer
1k views

ASA to non-ASA Site-to-site VPN - Tunnel not staying up

I have a site-to-site tunnel up between two locations (non-ASA initiator, ASA responder). The tunnel will come up but not stay up. I'm 95% sure I have an issue in my crypto maps but I'm at a loss. The ...
3
votes
5answers
9k views

Propagate VLAN through VPN (IPsec)?

I have a question about connecting two LANs (logically same LAN) over a VPN. In picture below you can see overall representation of our implementation. Description: On each side, we have distinct ...
3
votes
1answer
2k views

Site-to-Site IPsec VPN Tunnel - Certain Traffic Doesn't Work [closed]

I've been having some strange issues with some site-to-site IPsec tunnels using ESP and pre-shared keys that I've been working on for the past two weeks with no success. The tunnel has no problem ...
1
vote
0answers
903 views

Connection problem, site-to-site, VYOS

I'm having problem with a site-to-site. I think I have the basic setup working and I want to confirm that the tunnel is up and working. Here is what I have: vyos@<vpnxy>:~$ show vpn ipsec sa ...
5
votes
2answers
17k views

Cisco ASA 5506-X - Site-to-Site VPN Tunnel - Return traffic dropped

I've configured a Cisco ASA 5506-X for a customer of mine and I'm having trouble successfully passing traffic round-trip to the remote network. The VPN tunnel connects successfully according to 'show ...
1
vote
0answers
400 views

Change RADIUS auth method for remote access ipsec vpn

We have a Cisco 3825 router with an IPSec Remote Access VPN configured to authenticate against a radius server. We're retiring the old server and moving to a new one (Windows Server 2012). We changed ...
2
votes
0answers
1k views

IPSEC VPN between Cisco IOS and Checkpoint SA failure, one way works [closed]

I am trying to hook up a VPN between us and a customer. Customer has a Checkpoint FW (not sure which version), I have a 2811. Symptom: The tunnel (session) comes up, I can ping through, other side ...
4
votes
1answer
860 views

IOS to ASA dynamic and static VPNs - sharing same crypto ACL?

Is it possible to have a dynamic and static VPN between the same IOS router and ASA, sharing same interesting traffic/crypto ACL on the ASA end? The two devices in question: ASA 9.1 - hub/termination ...
2
votes
0answers
1k views

High count of packet retransmissions/Dups over IPSEC/VPN [closed]

I'm running IPSEC-VPN (AES256/SHA256/DH14) tunnel between a PaloAlto PA-500 and a Fortigate 110C via Internet (10MBit up/down guaranteed both sides - latency between 40 and 50ms). 90% connections are ...
1
vote
0answers
69 views

Issue with voice performance between two ip phones at the same site connecting to two different CUCM?

I have one branch which is (branch-1) with two groups of ip phones, one group is connecting to CUCM-1 in HQ and the other group is connecting to CUCM-2 in the branch (branch-1) and the connectivity ...
4
votes
1answer
4k views

Fortigate 30D IPSEC VPN could not locate phase1 configuration

Hello network engineers, I have an IPSEC VPN tunnel between two offices, the HQ is a fortigate 200B(os:v5.0,build0292 (GA Patch 9)) and the branch is fortigate 30D(os:5.2.3). Both are now on static ...
6
votes
2answers
6k views

How to configure Cisco remote access IPSEC VPN between IOS Router and Android phone

I have a C891FW router with IOS 15.4 on which I'm trying to configure a remote access VPN for Android's native VPN client. I'm authenticating with RSA-Sig and XAUTH. The tunnel forms but I can't reach ...
2
votes
1answer
74 views

IPsec tunnel with IPv6 and security gateways

Silvia Hagen wrote in one of her books (ISBN:9783952294222, page 463) the following (free translation from german): Tunneling, an essential element of IPsec [...], is problematic for existing ...
1
vote
1answer
2k views

Fortinet 60D acting as IPSec VPN Client?

Is there a way to make the Fortigate 60D act as a VPN client connecting to an ASA IPSec VPN without setting up a site-to-site VPN? In other words, have the Fortinet act as a typical PC would ...
1
vote
3answers
375 views

All tunnels down on Cisco 7204VXR with debug message “Unable to generate DH phase 2 parameters!”

I have 40 or 50 tunnels with over 200 SAs active on a 7204VXR with NPE-G1 using the software crypto engine (no VAS card installed). The working config was transferred over from a 2821 with AIM-VPN ...
4
votes
2answers
385 views

IPsec tunnel configuration question

I have a network that is comprised of a main office and multiple branch offices. The main office houses the servers and each branch office has an IPsec tunnel to the main office. There are no ...
3
votes
3answers
14k views

rec'd IPSEC packet has invalid spi

I have setup a lab to play with DMVPN and EIGRP. Everything works perfectly fine until I test things by shutting down redundant ports. Once I do that the DMVPNs never recover even after restoring all ...
0
votes
1answer
82 views

Can I configure IPSec on any Cisco Firewall?

I have done some search and I found that there is two series of cisco firewalls : Cisco ASA 5500 series and Cisco PIX 500 series firewalls. Do all Cisco Firewalls support IPSec configuration? ...