Questions tagged [vpn]

For questions about Virtual Private Networks (VPNs).

Filter by
Sorted by
Tagged with
78
votes
4answers
74k views

What's the difference between IKE and ISAKMP?

I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly)....
31
votes
8answers
35k views

What are the downsides of OpenVPN?

I have been seeing so many people always wrestling with IPSec, and many other secure VPN technologies. I, for one, have always simply used OpenVPN, with beautiful and simple and versatile results. I'...
26
votes
9answers
20k views

Why use SSH and VPN in combination?

My employer requires me to first log on to a VPN, and only then I can SSH into the servers. But, given the security of SSH, is a VPN overkill? What is the use of a VPN in terms of security if I am ...
21
votes
5answers
28k views

Cisco ASA site-to-site VPN failover

We recently replaced international MPLS with new ASA 5510s and site-to-site VPNs. However, when we deployed this we ran into a problem where each remote location has 2 ISPs for redundancy, but when ...
16
votes
5answers
205k views

How can I reset a VPN tunnel on a Cisco ASA?

On a site-to-site VPN using a ASA 5520 and 5540, respectively, I noticed that from time to time traffic doesn't pass any more, sometimes just there's even missing traffic just for one specific traffic ...
13
votes
1answer
49k views

Getting Cisco ISAKMP and IPSec SA lifetime confused

I always get confused about security association lifetime configuration on Cisco IOS. On most web-managed hardware it is clear which SA lifetime is for Phase I and which is for Phase II. On Cisco ...
12
votes
1answer
15k views

Site-to-Site VPN Tunnel Up Not Passing Traffic

I have a site-to-site VPN that seems to be dropping traffic from a particular subnet when a lot of data is being pushed through the tunnel. I have to run clear ipsec sa to get it going again. I ...
11
votes
2answers
14k views

In IPsec VPN, how is the pre-shared key encrypted?

I was doing IPsec VPN on ASA 8.0, and I understand a little about that. The initiator starts by sending its ISAKMP policy to the responder, and the responder sends back the matched policy. After that, ...
11
votes
3answers
5k views

What is the proper way to config a Site to Site IPSEC VPN and a Remote Access VLAN on the same external interface? Cisco 891 ISR

I'd be happy to post the config or logs for reference but I am having trouble getting my remote access VPN working on the same interface as my site to site IPSEC VPN. I am using a dynamic crypto map ...
10
votes
2answers
4k views

netstat -nr returning "0/1" -- what does that mean?

In exploring how my local openVPN virtual interface utun0 works, I came across the following data, and I don't know how to make sense of it. (I'm on a Mac) $ netstat -nr Routing tables Internet: ...
10
votes
2answers
424 views

Will ASA 5540 support 3000 simultaneous IPsec connections?

As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 ...
10
votes
4answers
6k views

ASA 5505 remote access VPN - Connection established, but no internet/access to internal subnet

Update Finally got upgraded to 9.1.4. I got everything configured, reenabled VPN, and was still having the same problem. So, I cleared all VPN config information and started from scratch. Below is my ...
10
votes
0answers
2k views

Openswan-Sonicwall VPN tunnel

I've been trying to figure this out but all the documentation I can find seems to be very old. The feeling seems to be that once Dell acquired Sonicwall, documentation became sparse and mostly useless....
9
votes
3answers
3k views

How do VPN's forward network traffic? (Layer 3)

I am looking for some info on how VPN's (Virtual Private Network) forward network traffic through its VPS (Virtual Private Server). Take an example where you are connected to a VPN. You make a ...
9
votes
3answers
11k views

What is the use of a tunnel interface on a cisco router?

What is a tunnel interface used for on a cisco router? What is the difference between setting up a VPN connection and a tunnel interface; or does this serve the same purpose?
9
votes
2answers
2k views

VPN's in cloud hosting/dedicated server environments, IPSec tunnels vs tinc

I am in the process of designing a virtual private network setup for a cloud hosting environment. Given our requirements I don't really see this as different from a dedicated server environment. The ...
9
votes
2answers
1k views

Cisco IPSec Site-to-site VPN. Permit traffic if VPN is down

Bit of 'belt and braces' configuration planning. Background: We have a successful site-to-site VPN link to our remote datacenter. The remote 'protected' network is also the IP network range that is ...
8
votes
7answers
3k views

Why would a VPN require a T1?

Forgive me as I have very little domain knowledge in this area, I'm helping out at my parent's office and was asked to look into speeding up the internet. They've been using this IT guy that I think ...
8
votes
3answers
15k views

What is the difference between VPLS vs Layer 2 VPN?

Apologies about the very open ended question, but I am struggling to differentiate between VPLS & L2 VPN's. I'm aware they both run over MPLS, but I can't find any documentation or sites that ...
8
votes
4answers
5k views

Does IPv6 remove the need for a VPN?

I know that a VPN may be used in lots of different ways for lots of different things, so I'm not suggesting that IPv6 removes the need for a VPN completely. I'm interested in one particular use-case: ...
8
votes
3answers
818 views

Placement of firewall for VPN RA and L2L tunnels

For Remote Access (RA) and LAN-to-LAN (L2L) VPN, I currently operate a pair of Cisco VPN 3005 Concentrators tied to Internet edge routers on the outside and the inside tied to an internal pair of PIX ...
8
votes
1answer
6k views

How to failover static ipsec vpn tunnels?

I have a network with resilient gateways whereby Customer sites use a default gateway to reach the internet edge routers and the primary route for traffic uses a lower metric. ipsec tunnels are ...
8
votes
2answers
6k views

Cisco GET VPN Configuration - Best Practices/Can the loopback be used?

I am in the process of re-ip addressing a large number of remote locations, all of which are using a Cisco GET VPN/GDOI configuration for encryption of the traffic. In the process, I also wanted to ...
8
votes
3answers
3k views

Advice for network & device configuration using Comcast Modem?

Summary My ultimate goal is to run a VPN through my Cisco Router, which to me means getting the Comcast Gateway out of the way. To this end, I would like to place my Cisco Router (and/or Switch) ...
8
votes
2answers
7k views

NAT with VPN Site to Site and Remote LANs with same IP address

I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...). For every remote LAN, I ...
7
votes
6answers
2k views

Users want to work remotely, but need to use the same LAN IP addresses

I have users that need to be able to work remotely. In their current environment they use workstations with unique software that requires their IP address remain the same. Now that they are working ...
7
votes
1answer
6k views

PPPoE vs L2TP protocols

I am trying to find differences between PPPoE and L2TP.Both are tunneling protocols. When to use what? thanks, GL
7
votes
1answer
11k views

Using a Cisco router as an L2TP client?

I have a customer that for various reasons has a Cisco router sitting behind a NATed ADSL connection. They want to create a VPN to one of our points of presence and the only options we offer are site ...
7
votes
1answer
15k views

Juniper SRX: Where do I look to see IKE debug messages?

Going through a JSEC book I noticed the following slide explains that there are 6 ike phase 1 messages that take place for a tunnel to establish. I am looking in the kmd log and traceoptions data but ...
7
votes
1answer
1k views

Reliable connectivity to China [closed]

I have been struggling on getting reliable connectivity to China (AS4837 China Unicom Backbone, AS4134 China Telecom Backbone, AS4538 China Education and Research Network Center) On most links I have ...
7
votes
1answer
14k views

Timeouts for ASA VPN peers

I have configured a remote site with two IP addresses for data centre VPN peers - one primary (1.1.1.1), one backup (2.2.2.2). When the primary peer fails, the remote site detects the failure using ...
7
votes
2answers
3k views

VPN routing for hosts with multiple ip addresses [closed]

I use Mikrotik RouterOS as the NAT router. Some hosts behind the router also have a direct connection to the Internet and these hosts have a default route to the ISP's gateway instead of RouterOS. I ...
7
votes
1answer
3k views

Problem with VPN tunel from remote location through ISP (PPTP)

I have network situation like this: ISP Router (modem) - device given to us by our ISP - modem & router in one but it is set into transparent mode - ISP say so ;D we have to find it that it is ...
7
votes
1answer
13k views

Ipsec vpn, phase 2 unable to come up

I'm pretty sure I know the answer to this but I don't know how to implement it. Trying to setup an ipsec vpn from a Cisco 2811 to a linux box running openswan. So far I can get phase 1 up but ...
6
votes
6answers
2k views

What are the reasons for choosing separate or combined VPN and Internet routers?

Here's a network design question: I've just been reading "IPv6 for Enterprise Networks" by McFarland et. al. and it (among other Cisco documents) separates out Internet routing from remote access VPN. ...
6
votes
1answer
3k views

VPN Connection: Can ping printer but not server what is blocking things?

I have a VPN set up between several offices. All but one work fine. With one office, I can ping the printer 192.168.45.30 but not a server 192.168.45.242. Well, I say I can't but when the server was ...
6
votes
2answers
2k views

In MPLS VPN, Which one become first? MPLS Label tag or VPN encapsulation?

In MPLS VPN network, which one is the first thing to do? I mean label tagging is first or VPN encapsulation is first? If you can, please explain about this case.
6
votes
3answers
5k views

Cisco VPN Logs Do Not Show The Username

I have a Cisco VPN (not sure exactly which hardware) whose logs are forwarded to our Splunk server. It appears the username is redacted. All I see are asterisks. Is this something that can be changed ...
6
votes
3answers
1k views

RA VPN notification

I've got a vendor that supports some specialized equipment, the network engineer before me set them up with remote access VPN terminating to a Cisco ASA 5510 so they can remotely administer/...
6
votes
4answers
5k views

Cisco ASA 5505 Remote Users Cannot Access site-to-site tunnel

I've (finally) got a VPN tunnel to an AWS VPC up and running. I'm not a network engineer. It works fine from the office to the VPC, but remote users cannot access anything through this site-to-site ...
6
votes
2answers
4k views

Cisco PBR with DMVPN and Dual ISP

I have a DMVPN hub with 2 ISPs. I have two tunnels setup between the spokes, one for each ISP. I would like to dedicate one of the ISP links to voice traffic and failover. I'm having trouble achieving ...
6
votes
1answer
23k views

Cisco IPSEC VPN fail Stage 2

The HUB is managed at a data center with external IP 200.200.200.200. There are 10 remote offices. Office 9 HUB 10.1.9.0 - 100.100.100.100 ->> VPN <<-...
6
votes
1answer
1k views

After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel

After upgrading our ASAs from 9.1(1) to newer versions, users were no longer able to connect using native IPsec VPN client software when inside of an office network. From outside networks it still ...
6
votes
2answers
6k views

Traffic from route-map to crypto-map

This is sort of an offshoot of my previous question Ipsec vpn, phase 2 unable to come up. The VPN is up and working but now I'm having an issue with getting the right traffic across it. The only ...
6
votes
2answers
3k views

Policy Based Routing for VPN connections with VPN Client configuration

We have a Cisco 2800 router in our company that also serves as a VPN server. We use the VPN Client to connect to our corporate network (pls don't laugh, I know that it is very obsolete but I haven't ...
6
votes
3answers
3k views

Quagga OSPF DR/BDR Mismatch: Losing Routes

I am experiencing a problem with lost routes in an OSPF over DMVPN environment. I am running ubuntu server 14.04 with Quagga 0.99.22.4, and OpenNHRP 0.14.1. While technically the DMVPN network is an ...
6
votes
1answer
6k views

VPN client to multiple locations simultaneously

I need to connect to 15+ locations to run network scans weekly. All the locations have Fortigate firewalls over which I have full control. The current solution I have is to connect via IPSec VPN to ...
6
votes
1answer
2k views

Having trouble setting up VPN on a Cisco RV180W

Trying to setup a VPN for our small business (more secure and useful than the WebDAV we currently use) - but I'm having trouble getting it to work. I've not had to setup any VPN before, so have read ...
6
votes
2answers
2k views

ASA VPN communication issue

I have got an issue where SPOKE 1 and SPOKE 2 cannot communicate with each other. However, SPOKE 1 and SPOKE 2 can communicate with HUB. Please see configuration below for spoke and hub. SPOKE 1 (...
6
votes
2answers
6k views

How to configure Cisco remote access IPSEC VPN between IOS Router and Android phone

I have a C891FW router with IOS 15.4 on which I'm trying to configure a remote access VPN for Android's native VPN client. I'm authenticating with RSA-Sig and XAUTH. The tunnel forms but I can't reach ...

1
2 3 4 5
13