16
votes
Accepted
In IPsec VPN, how is the pre-shared key encrypted?
You've asked a great question. The question seems very simple, but in fact the answer is somewhat more complex. I'll do my best to answer it in a succinct manner. Also, since you mentioned ISAKMP, ...
- 13.9k
7
votes
IPSec based VPN using Openswan - IP confusion
Most of your answers can be found here:
http://linux.die.net/man/5/ipsec.conf
To speak through them however:
left will specify the IP address of the left peer, as it is seen from the right peer. ...
- 13.9k
7
votes
Accepted
IPSec failure with `IKE message failed its sanity check or is malformed`
Answering my own question: the solution was:
Use the correct group name in the client config (VPN_CLIENTS in example)
Use the group's key (secret3) in the client, not the main key (secret2) (latter ...
- 15.9k
6
votes
Accepted
Cisco IPSEC VPN fail Stage 2
Access lists aren't a problem here.
The output from show cypro isakmp sa tells you that the key negotiation is failing (MM_NO_STATE).
The log entry says that the hub wants to use a transform set (...
- 62.1k
6
votes
Accepted
Can we change peer IP of IPSec VPN tunnel in one line?
Can I change that simply by typing the following in conf t:
In your example, issuing crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3 will append 0.9.8.7 6.5.4.3 to your existing peer list for ...
- 1,626
6
votes
Confused on perfect forward secrecy, someone kindly help me
The link you provided was broken, so I couldn't validate the context.
But, as I contributed to the other thread, I might be in a good place to help contribute to this =).
At the end of ISAKMP (Phase ...
- 13.9k
6
votes
MTU/MSS Oddness?
Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately).
https://cway.cisco.com/ipsec-overhead-calculator/
From where we can draw, based on your IPSec settings and a few common ...
- 7,696
6
votes
Is it possible to implement IPSEC over MPLS?
If your MPLS L3VPN supports IP transport from endpoint A to/from endpoint B at the other site (which is their primary purpose), there's nothing to stop you from letting A and B talk IPSec (in one or ...
- 7,696
5
votes
In IPsec VPN, how is the pre-shared key encrypted?
Your answer is in your question: The Diffie-Hellman exchange is used to generate a common key to securely exchange a common key (i.e. pre-share).
See this: https://security.stackexchange.com/...
- 62.1k
5
votes
Accepted
After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel
Yes, the device can be instructed to accept the client VPN connections from the peer that it already has an open tunnel with.
This is done by updating the dynamic map to include new entries with a ...
- 615
5
votes
Accepted
Site-to-Site IPsec VPN tunnel with an additional remote network/subnet
1
What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied:
At your ...
- 3,744
5
votes
Accepted
How to keep an ASA tunnel up for lifetime?
You should be able to disable this in the group policy attributes.
group-policy "policy_name" attributes
vpn-idle-timeout none
- 536
5
votes
Accepted
IPSec site-to-site with/without NAT
If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel.
If you want the 11.11....
- 13.9k
5
votes
Accepted
Use cases for GRE over IPSEC
Running multicast or multicast based routing protocols does not necessarily require GRE-over-IPsec. "Tunnel based" or "route based" VPN (tunnel mode ipsec ipv4 a.k.a. IPsec Virtual Tunnel Interfaces ...
- 7,696
5
votes
Accepted
How IPsec tunnel mode work without GRE
So what's the difference between GRE+IPsec and IPsec only?
In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet.
The ...
- 62.1k
5
votes
Is Cisco IPsec different from ordinary IPsec?
Both Windows L2TP/IPsec and Cisco IPsec are different from ordinary IPsec.
Originally the "ordinary" IPsec handshake protocol (IKEv1) did not have any features to negotiate the client's VPN ...
- 259
4
votes
Accepted
IPsec, how to differentiate TCP and UDP
Assuming you mean to protect confidentiality of the communication at IP layer with IPsec:
How would the underlying network be able to differentiate between UDP
and TCP since they're at the ...
- 588
4
votes
Why do multi-line crypto ACL's create instability in VPN tunnels?
If you're talking Cisco, each acl record is it's own SA (tunnel). FWIW, the Cisco PIX/ASA will not allow an "any" rule. (which is why an IOS tunnel interface cannot terminate to a PIX/ASA.)
What ...
- 29.5k
4
votes
Accepted
Deploying an IPSEC secure-channel - isakmp SA empty
If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers.
In this case there are several problems in your configuration as far as I can ...
- 56
4
votes
Accepted
Cisco ASA 5520 - Create local VPN pool
ASA VPN address pools can be a /22 (or larger) and function correctly.
The limitation of how many of those addresses can actually be active at any one time is based on the hardware in use. The 5520 ...
- 1,470
4
votes
Accepted
Have Cisco ASA 5505 and want it to maintain site-to-site VPN connections
If you want to keep the ASA for the L2L tunnels you could assign a second public IP to the new firewall and not modify the ASA. Then set your default route to the new firewall and add routes for the ...
- 3,032
4
votes
Will an asa pass traffic that matches a crypto map entry if Phase 2 is not completed?
If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up). If the build attempt fails, no traffic will make it to the outside interface.
- 13.9k
4
votes
IPsec tunnel configuration question
Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1
I will ...
- 141
4
votes
Fortigate "remembers" bad routes
First off, this behavior is as expected.
The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and ...
- 880
4
votes
Accepted
High number of "pkts replay failed" on Cisco ASA
This happens occasionally when you have a very busy VPN tunnel (>200 packets per second). To understand why, you have to first understand what Anti-Replay is doing.
Anti-Replay
The goal of Anti-...
- 13.9k
4
votes
Accepted
Does any router support line-speed throughput for a single IPSec tunnel?
Yes. The Cisco ASR 1001-HX is one that is advertised to do it. Just step through 2 clicks of Cisco's router selector and see all the boxes that do 10G+ of IPSec.
- 4,163
4
votes
How to check if IPSec is available on Cisco ISR 4451
On the router console, type
show version
If the image name includes the letters "K9", as in C3000-UNIVERSALK9-M, then yes. Otherwise, no.
You can also type a command like
show crypto isakmp sa
...
- 62.1k
4
votes
Accepted
How to check if IPSec is available on Cisco ISR 4451
Check your license boot:
show run | include boot
And if you don't see it there already, add it like this:
license boot level appxk9
*edit: in your case, you need license boot level securityk9
After ...
- 208
4
votes
Accepted
Cisco ASA single isakmp policy for multiple crypto map
The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and ...
- 3,744
Only top scored, non community-wiki answers of a minimum length are eligible