Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Hot answers tagged

6 votes

MTU/MSS Oddness?

Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately). https://cway.cisco.com/ipsec-overhead-calculator/ From where we can draw, based on your IPSec settings and a few common ...
user avatar
5 votes
Accepted

Problem with getting IKEv1 tunnel between Cisco and Palo Alto to establish a tunnel more quickly

It seems you have a wider issue that this specific message. 10 minutes to re-established a tunnel is totally abnormal. Here is a few points you should check: don't use IKEv1 anymore, switch to IKEv2 ...
user avatar
  • 18.3k
5 votes
Accepted

Why does IKE use UDP instead of TCP?

Originally, UDP was chosen over TCP because of its lower latency and processing requirements. Also, if ISPs followed the IETF standards, this wouldn't be an issue. There has been a movement to add TCP ...
user avatar
  • 93k
4 votes

Why does IKE use UDP instead of TCP?

IKE is mean to encapsulate other communication. If that "other communication" requires all the L4 error correction that TCP offers, than the "other communication" should use TCP. In this way, IKE/...
user avatar
  • 13.9k
4 votes
Accepted

Wireshark Decrypting IKEv1 Text PSK to Hex

What you have to configure in Wireshark is not the PSK used for authentication, but the actual IKE encryption keys, which are derived from an ephemeral Diffie-Hellman exchange (i.e. they are different ...
user avatar
  • 278
4 votes
Accepted

MTU/MSS Oddness?

REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved. The MTU information helped guide us down a ...
user avatar
4 votes
Accepted

Deploying an IPSEC secure-channel - isakmp SA empty

If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers. In this case there are several problems in your configuration as far as I can ...
user avatar
4 votes
Accepted

Advertise static route via BGP from Cisco ASA 5512-x

I believe the feature you are looking for is "Reverse Route Injection". Reverse route injection (RRI) is the ability for static routes to be automatically inserted into the routing process for ...
user avatar
  • 1,241
3 votes
Accepted

Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates?

The short answer is no: My question is, is there an equivalent command for the certificate being used by the remote peer to validate themselves? The only options for viewing remote certificate ...
user avatar
3 votes
Accepted

Can both IPsec endpoint be configured as the initiator?

I manage dozens of IPSEC tunnels with various equipment: Cisco ASA, Fortigate, Sophos, Juniper, linux based devices, etc... and I usually configure both endpoint as initiator and never had issue. The ...
user avatar
  • 18.3k
3 votes
Accepted

Why is IKE needed for IPSec VPN?

Simply because IPsec was not built to initially include a Key Exchange. In fact, early implementations of IPsec expected you to manually configure an IPsec Key, from which Encryption and ...
user avatar
  • 13.9k
3 votes

IKEv2 Site to Site from Cisco ASA 5506 to Azure "RouteBased" VPN

Azure Route-Based VPNs actually do support Cisco ASAs, but you have to configure Policy Based Traffic Selectors on the Azure Gateway.
user avatar
  • 31
2 votes

Multiple IPSEC tunnels between 2 Cisco Routers

You could build this quite simply using VTIs (GRE tunnels with IPSec protection). As the two tunnels have the same source, destination IP pairs, you will need to make sure you use a unique (per tunnel)...
user avatar
2 votes
Accepted

ASA VPN works as responder but not as initiator

I've seen similar behavior when the Phase 2 SA liftetime settings don't match. You may want to try matching both your Phase 1 and 2 lifetime settings. This is your Phase 1 lifetime configuration on ...
user avatar
2 votes

Azure VPN vs. Cisco ASA

You're missing the corresponding crypto map statements for that tunnel. Without the crypto map statements, you can't form Phase 2. Dynamic tunnels, like you were asking about, are only for when your ...
user avatar
  • 4,436
2 votes
Accepted

IKE phase 1 and phase 2

Good questions. 1)The 1st and 2nd packets are transfer of SA proposals and cookies. Question:Arent the cookies generated by hashing the senders IP, port , protocol and timestamp? If thats the case, ...
user avatar
  • 13.9k
2 votes

IKE phase 1 and phase 2

ISAKMP/IKEv1 is deprecated and should not be used anymore, it was replaced by IKEv2. Arent the cookies generated by hashing the senders IP, port , protocol and timestamp? It's open to ...
user avatar
  • 278
1 vote
Accepted

IKEv2 notification payload regarding IKE SA

I found the answer further above in page 16 of RFC7296 There is no need to send a notification payload regarding a different IKE SA. The current IKE SA is already in the IKE header. The first of these ...
user avatar
1 vote

IKEV2 between ASA and Router problem

You have, on your router config, the IKEv2 policy set to aes-sha with dh 2, 5. On the ASA, the policy is for 3des-sha and group 5, 2. Also note that you have not set lifetime nor prf settings on the ...
user avatar
1 vote
Accepted

IPSEC Phase 1 error

MM_NO_STATE means Main Mode No State. That is, the state machine is still in the initial state because it hasn't received any response from the peer. Feb 18 09:26:06.732: ISAKMP:(0): retransmitting ...
user avatar
  • 62.1k
1 vote
Accepted

IPSec SA being Unidirectional

I think your confusion stems from misunderstanding a few terms. For what its worth, there is a lot of confusion around these terms. A Policy Suite is a grouping of specific algorithms for the sake of ...
user avatar
  • 13.9k
1 vote
Accepted

Cisco 5506-x dynamic site to site tunnel doesn't works

On ASA2 (dynamic peer), you did not set the VPN peer - 10.0.0.1 in your crypto map outside_map 1. Please try the followings on ASA2: Remove crypto map outside_map 1 set pfs Add crypto map outside_map ...
user avatar
  • 3,744
1 vote

What's the difference between IKE and ISAKMP?

Please check whether this helps, I know that I am late :) Yes, this is from the Wikipedia article, Internet Security Association and Key Management Protocol, but I didn't see any references so far to ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible