Skip to main content
6 votes

MTU/MSS Oddness?

Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately). https://cway.cisco.com/ipsec-overhead-calculator/ From where we can draw, based on your IPSec settings and a few common ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

Problem with getting IKEv1 tunnel between Cisco and Palo Alto to establish a tunnel more quickly

It seems you have a wider issue that this specific message. 10 minutes to re-established a tunnel is totally abnormal. Here is a few points you should check: don't use IKEv1 anymore, switch to IKEv2 ...
JFL's user avatar
  • 19.7k
5 votes
Accepted

Why does IKE use UDP instead of TCP?

Originally, UDP was chosen over TCP because of its lower latency and processing requirements. Also, if ISPs followed the IETF standards, this wouldn't be an issue. There has been a movement to add TCP ...
Ron Maupin's user avatar
  • 99.9k
4 votes
Accepted

Wireshark Decrypting IKEv1 Text PSK to Hex

What you have to configure in Wireshark is not the PSK used for authentication, but the actual IKE encryption keys, which are derived from an ephemeral Diffie-Hellman exchange (i.e. they are different ...
ecdsa's user avatar
  • 303
4 votes
Accepted

MTU/MSS Oddness?

REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved. The MTU information helped guide us down a ...
Thomas Ward's user avatar
4 votes

Why does IKE use UDP instead of TCP?

IKE is mean to encapsulate other communication. If that "other communication" requires all the L4 error correction that TCP offers, than the "other communication" should use TCP. In this way, IKE/...
Eddie's user avatar
  • 15.1k
4 votes
Accepted

Deploying an IPSEC secure-channel - isakmp SA empty

If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers. In this case there are several problems in your configuration as far as I can ...
0xc3faadd3's user avatar
4 votes
Accepted

Advertise static route via BGP from Cisco ASA 5512-x

I believe the feature you are looking for is "Reverse Route Injection". Reverse route injection (RRI) is the ability for static routes to be automatically inserted into the routing process for ...
TDurden's user avatar
  • 1,241
3 votes
Accepted

Why is IKE needed for IPSec VPN?

Simply because IPsec was not built to initially include a Key Exchange. In fact, early implementations of IPsec expected you to manually configure an IPsec Key, from which Encryption and ...
Eddie's user avatar
  • 15.1k
3 votes

IKEv2 Site to Site from Cisco ASA 5506 to Azure "RouteBased" VPN

Azure Route-Based VPNs actually do support Cisco ASAs, but you have to configure Policy Based Traffic Selectors on the Azure Gateway.
Mark's user avatar
  • 31
3 votes
Accepted

Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates?

The short answer is no: My question is, is there an equivalent command for the certificate being used by the remote peer to validate themselves? The only options for viewing remote certificate ...
Benjamin Dale's user avatar
3 votes
Accepted

Can both IPsec endpoint be configured as the initiator?

I manage dozens of IPSEC tunnels with various equipment: Cisco ASA, Fortigate, Sophos, Juniper, linux based devices, etc... and I usually configure both endpoint as initiator and never had issue. The ...
JFL's user avatar
  • 19.7k
2 votes
Accepted

IPSec SA being Unidirectional

I think your confusion stems from misunderstanding a few terms. For what its worth, there is a lot of confusion around these terms. A Policy Suite is a grouping of specific algorithms for the sake of ...
Eddie's user avatar
  • 15.1k
2 votes

Azure VPN vs. Cisco ASA

You're missing the corresponding crypto map statements for that tunnel. Without the crypto map statements, you can't form Phase 2. Dynamic tunnels, like you were asking about, are only for when your ...
Jesse P.'s user avatar
  • 4,690
2 votes
Accepted

IKE phase 1 and phase 2

Good questions. 1)The 1st and 2nd packets are transfer of SA proposals and cookies. Question:Arent the cookies generated by hashing the senders IP, port , protocol and timestamp? If thats the case, ...
Eddie's user avatar
  • 15.1k
2 votes

IKE phase 1 and phase 2

ISAKMP/IKEv1 is deprecated and should not be used anymore, it was replaced by IKEv2. Arent the cookies generated by hashing the senders IP, port , protocol and timestamp? It's open to ...
ecdsa's user avatar
  • 303
2 votes

Multiple IPSEC tunnels between 2 Cisco Routers

You could build this quite simply using VTIs (GRE tunnels with IPSec protection). As the two tunnels have the same source, destination IP pairs, you will need to make sure you use a unique (per tunnel)...
Patrick Mackey's user avatar
2 votes

IPsec PFS Confusion

Each implementation may vary in some details and some functions and features of any IPSec peer relationship will be negotiated for each connection but the basic idea is that each Quick Mode during the ...
FrameHowitzer's user avatar
1 vote

Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

There were 4 hosts on the remote side of the tunnel. I had accidentally listed them twice in the object group for the NAT rule. Once I corrected that mistake everything worked.
Chris Holt's user avatar
1 vote
Accepted

IKEv2 notification payload regarding IKE SA

I found the answer further above in page 16 of RFC7296 There is no need to send a notification payload regarding a different IKE SA. The current IKE SA is already in the IKE header. The first of these ...
Mathias Weidner's user avatar
1 vote

IKEV2 between ASA and Router problem

You have, on your router config, the IKEv2 policy set to aes-sha with dh 2, 5. On the ASA, the policy is for 3des-sha and group 5, 2. Also note that you have not set lifetime nor prf settings on the ...
sietecFAST's user avatar
1 vote
Accepted

IPSEC Phase 1 error

MM_NO_STATE means Main Mode No State. That is, the state machine is still in the initial state because it hasn't received any response from the peer. Feb 18 09:26:06.732: ISAKMP:(0): retransmitting ...
Ron Trunk's user avatar
  • 67.7k
1 vote

What's the difference between IKE and ISAKMP?

Internet Security Association Key Management Protocol (ISAKMP) is a framework for authentication and key exchange between two peers to establish, modify, and tear down SAs. It is designed to support ...
Jim Forristal's user avatar
1 vote
Accepted

Cisco 5506-x dynamic site to site tunnel doesn't works

On ASA2 (dynamic peer), you did not set the VPN peer - 10.0.0.1 in your crypto map outside_map 1. Please try the followings on ASA2: Remove crypto map outside_map 1 set pfs Add crypto map outside_map ...
Hung Tran's user avatar
  • 3,754
1 vote

IPSec IKEv2 connection failure due to RSA authentication issue

first shot: change the ipsec-transform-set to crypto ipsec transform-set crp_ph2_ts esp-aes esp-sha-hmac. (remove the "256") Or try to use the "default"-transform-set. Have seen a ...
Ron's user avatar
  • 11
1 vote

IPsec IKEv2 with StrongSwan Cert+EAP not working

crypto ikev2 proposal IKEV2-PROP encryption aes-cbc-256 integrity sha256 group 14 ! crypto ikev2 policy IKEV2-POL proposal IKEV2-PROP ! crypto ikev2 profile IKEV2-PROFILE match identity remote ...
warashi nguyen's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible