6
votes
MTU/MSS Oddness?
Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately).
https://cway.cisco.com/ipsec-overhead-calculator/
From where we can draw, based on your IPSec settings and a few common ...
- 8,674
5
votes
Accepted
Problem with getting IKEv1 tunnel between Cisco and Palo Alto to establish a tunnel more quickly
It seems you have a wider issue that this specific message.
10 minutes to re-established a tunnel is totally abnormal.
Here is a few points you should check:
don't use IKEv1 anymore, switch to IKEv2
...
- 19.4k
5
votes
Accepted
Why does IKE use UDP instead of TCP?
Originally, UDP was chosen over TCP because of its lower latency and processing requirements. Also, if ISPs followed the IETF standards, this wouldn't be an issue. There has been a movement to add TCP ...
- 98.3k
4
votes
Why does IKE use UDP instead of TCP?
IKE is mean to encapsulate other communication. If that "other communication" requires all the L4 error correction that TCP offers, than the "other communication" should use TCP.
In this way, IKE/...
- 14.8k
4
votes
Accepted
Wireshark Decrypting IKEv1 Text PSK to Hex
What you have to configure in Wireshark is not the PSK used for authentication, but the actual IKE encryption keys, which are derived from an ephemeral Diffie-Hellman exchange (i.e. they are different ...
- 278
4
votes
Accepted
MTU/MSS Oddness?
REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved.
The MTU information helped guide us down a ...
- 181
4
votes
Accepted
Advertise static route via BGP from Cisco ASA 5512-x
I believe the feature you are looking for is "Reverse Route Injection".
Reverse route injection (RRI) is the ability for static routes to be
automatically inserted into the routing process for ...
- 1,241
4
votes
Accepted
Deploying an IPSEC secure-channel - isakmp SA empty
If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers.
In this case there are several problems in your configuration as far as I can ...
- 56
3
votes
Accepted
Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates?
The short answer is no:
My question is, is there an equivalent command for the certificate
being used by the remote peer to validate themselves?
The only options for viewing remote certificate ...
- 9,381
3
votes
Accepted
Can both IPsec endpoint be configured as the initiator?
I manage dozens of IPSEC tunnels with various equipment: Cisco ASA, Fortigate, Sophos, Juniper, linux based devices, etc... and I usually configure both endpoint as initiator and never had issue.
The ...
- 19.4k
3
votes
Accepted
Why is IKE needed for IPSec VPN?
Simply because IPsec was not built to initially include a Key Exchange. In fact, early implementations of IPsec expected you to manually configure an IPsec Key, from which Encryption and ...
- 14.8k
3
votes
IKEv2 Site to Site from Cisco ASA 5506 to Azure "RouteBased" VPN
Azure Route-Based VPNs actually do support Cisco ASAs, but you have to configure Policy Based Traffic Selectors on the Azure Gateway.
- 31
2
votes
Multiple IPSEC tunnels between 2 Cisco Routers
You could build this quite simply using VTIs (GRE tunnels with IPSec protection). As the two tunnels have the same source, destination IP pairs, you will need to make sure you use a unique (per tunnel)...
2
votes
Azure VPN vs. Cisco ASA
You're missing the corresponding crypto map statements for that tunnel. Without the crypto map statements, you can't form Phase 2. Dynamic tunnels, like you were asking about, are only for when your ...
- 4,690
2
votes
Accepted
IKE phase 1 and phase 2
Good questions.
1)The 1st and 2nd packets are transfer of SA proposals and cookies.
Question:Arent the cookies generated by hashing the senders IP, port ,
protocol and timestamp? If thats the case, ...
- 14.8k
2
votes
IKE phase 1 and phase 2
ISAKMP/IKEv1 is deprecated and should not be used anymore, it was replaced by IKEv2.
Arent the cookies generated by hashing the senders IP, port , protocol and timestamp?
It's open to ...
- 278
2
votes
What's the difference between IKE and ISAKMP?
Please check whether this helps, I know that I am late :)
Yes, this is from the Wikipedia article, Internet Security Association and Key Management Protocol, but I didn't see any references so far to ...
- 21
2
votes
IPsec PFS Confusion
Each implementation may vary in some details and some functions and features of any IPSec peer relationship will be negotiated for each connection but the basic idea is that each Quick Mode during the ...
- 1,931
1
vote
Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes
There were 4 hosts on the remote side of the tunnel. I had accidentally listed them twice in the object group for the NAT rule. Once I corrected that mistake everything worked.
- 213
1
vote
Accepted
IKEv2 notification payload regarding IKE SA
I found the answer further above in page 16 of RFC7296
There is no need to send a notification payload regarding a different IKE SA. The current IKE SA is already in the IKE header.
The first of these ...
- 161
1
vote
IKEV2 between ASA and Router problem
You have, on your router config, the IKEv2 policy set to aes-sha with dh 2, 5. On the ASA, the policy is for 3des-sha and group 5, 2. Also note that you have not set lifetime nor prf settings on the ...
- 68
1
vote
Accepted
IPSEC Phase 1 error
MM_NO_STATE means Main Mode No State. That is, the state machine is still in the initial state because it hasn't received any response from the peer.
Feb 18 09:26:06.732: ISAKMP:(0): retransmitting ...
- 66.9k
1
vote
Accepted
IPSec SA being Unidirectional
I think your confusion stems from misunderstanding a few terms. For what its worth, there is a lot of confusion around these terms.
A Policy Suite is a grouping of specific algorithms for the sake of ...
- 14.8k
1
vote
Accepted
Cisco 5506-x dynamic site to site tunnel doesn't works
On ASA2 (dynamic peer), you did not set the VPN peer - 10.0.0.1 in your crypto map outside_map 1.
Please try the followings on ASA2:
Remove crypto map outside_map 1 set pfs
Add crypto map outside_map ...
- 3,754
Only top scored, non community-wiki answers of a minimum length are eligible