7
votes
IPSec based VPN using Openswan - IP confusion
Most of your answers can be found here:
http://linux.die.net/man/5/ipsec.conf
To speak through them however:
left will specify the IP address of the left peer, as it is seen from the right peer. ...
- 15k
7
votes
Accepted
IPSec failure with `IKE message failed its sanity check or is malformed`
Answering my own question: the solution was:
Use the correct group name in the client config (VPN_CLIENTS in example)
Use the group's key (secret3) in the client, not the main key (secret2) (latter ...
- 16.2k
6
votes
Confused on perfect forward secrecy, someone kindly help me
The link you provided was broken, so I couldn't validate the context.
But, as I contributed to the other thread, I might be in a good place to help contribute to this =).
At the end of ISAKMP (Phase ...
- 15k
6
votes
MTU/MSS Oddness?
Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately).
https://cway.cisco.com/ipsec-overhead-calculator/
From where we can draw, based on your IPSec settings and a few common ...
- 8,826
6
votes
What's the advantage of IPSec over TLS/DTLS?
At a high level, they are equivalent. They are both "Secure Communication" protocols which create a "tunnel" between two end points. Data transferred within this tunnel is ...
- 15k
6
votes
Is it possible to implement IPSEC over MPLS?
If your MPLS L3VPN supports IP transport from endpoint A to/from endpoint B at the other site (which is their primary purpose), there's nothing to stop you from letting A and B talk IPSec (in one or ...
- 8,826
5
votes
Accepted
Site-to-Site IPsec VPN tunnel with an additional remote network/subnet
1
What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied:
At your ...
- 3,754
5
votes
Accepted
How to keep an ASA tunnel up for lifetime?
You should be able to disable this in the group policy attributes.
group-policy "policy_name" attributes
vpn-idle-timeout none
- 536
5
votes
Accepted
IPSec site-to-site with/without NAT
If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel.
If you want the 11.11....
- 15k
5
votes
Accepted
Use cases for GRE over IPSEC
Running multicast or multicast based routing protocols does not necessarily require GRE-over-IPsec. "Tunnel based" or "route based" VPN (tunnel mode ipsec ipv4 a.k.a. IPsec Virtual Tunnel Interfaces ...
- 8,826
5
votes
Accepted
How IPsec tunnel mode work without GRE
So what's the difference between GRE+IPsec and IPsec only?
In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet.
The ...
- 67.1k
5
votes
Is Cisco IPsec different from ordinary IPsec?
Both Windows L2TP/IPsec and Cisco IPsec are different from ordinary IPsec.
Originally the "ordinary" IPsec handshake protocol (IKEv1) did not have any features to negotiate the client's VPN ...
- 309
4
votes
Accepted
Deploying an IPSEC secure-channel - isakmp SA empty
If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers.
In this case there are several problems in your configuration as far as I can ...
- 56
4
votes
IPsec tunnel configuration question
Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1
I will ...
- 141
4
votes
Fortigate "remembers" bad routes
First off, this behavior is as expected.
The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and ...
- 880
4
votes
Accepted
High number of "pkts replay failed" on Cisco ASA
This happens occasionally when you have a very busy VPN tunnel (>200 packets per second). To understand why, you have to first understand what Anti-Replay is doing.
Anti-Replay
The goal of Anti-...
- 15k
4
votes
Accepted
Does any router support line-speed throughput for a single IPSec tunnel?
Yes. The Cisco ASR 1001-HX is one that is advertised to do it. Just step through 2 clicks of Cisco's router selector and see all the boxes that do 10G+ of IPSec.
- 4,399
4
votes
How to check if IPSec is available on Cisco ISR 4451
On the router console, type
show version
If the image name includes the letters "K9", as in C3000-UNIVERSALK9-M, then yes. Otherwise, no.
You can also type a command like
show crypto isakmp sa
...
- 67.1k
4
votes
Accepted
How to check if IPSec is available on Cisco ISR 4451
Check your license boot:
show run | include boot
And if you don't see it there already, add it like this:
license boot level appxk9
*edit: in your case, you need license boot level securityk9
After ...
- 208
4
votes
Accepted
Cisco ASA single isakmp policy for multiple crypto map
The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and ...
- 3,754
4
votes
Accepted
ASA IPsec Removing peer from correlator table failed, no match
With access-list ACL-VPN-SITE-1, you can have mullple lines for different subnets at Site-1.
If you would like to have a single-line access-list, you need to put all subnets (for VPN traffic) at Site-...
- 3,754
4
votes
Accepted
How are VPN Clients given IP addresses when they connect to VPN Routers such as VyOS? (How do Virtual IP Address Pools fit in?)
DHCP requires a link layer which doesn't really exist for VPN clients. Usually, a routed VPN connection is used and the VIPAP pool is used instead of the non-existent DHCP pool.
With a bridged VPN ...
- 82.7k
4
votes
Accepted
IPSec route-based vpn st0 interface
Traffic will still flow between A and D if you set the next-hop of B or C instead of st0.0 (assuming there are no NAT or security policy issues) however you will no longer be routing through the ...
- 9,421
4
votes
Accepted
Keep Cisco site-to-site tunnel up permanently
Your options are:
The IP SLA
Always be sending something over the tunnel from host/server to host/server to keep the tunnel up (effectively just another form of an IP SLA)
Configure the lifetimes on ...
- 4,690
4
votes
Accepted
MAC Address not resolving when IPSec VPN in place
MAC addresses are only seen or relevant on the local network. Routers strip off the layer-2 frames, losing the original MAC addresses, in order to route the packets. Routers will then build new frames ...
- 98.8k
4
votes
Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?
SCEP (https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) is another protocol to get CSRs from and certificates back to a large number of devices - provided they can generate their ...
- 8,826
4
votes
Accepted
MTU/MSS Oddness?
REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved.
The MTU information helped guide us down a ...
- 181
4
votes
Accepted
Why does IKEv2 forbid dynamic address updates for hosts behind NAT?
Read the entire paragraph. They're talking about how to handle a dynamic address changing mid-connection, which could be due to a NAT timeout, NAT table reset ("reboot"), or the node simply ...
- 31.8k
3
votes
Accepted
Which layer does IPSec work
IPSec Tunnel Mode.
IPSec is above the IP layer, but inside the encrypted IPSec packet, there is the original IP and payload.
IPSec wraps the original packet, encrypts it, adds a new IP header and ...
- 1,427
Only top scored, non community-wiki answers of a minimum length are eligible