As of May 31, 2023, we have updated our Code of Conduct.

Hot answers tagged

7 votes

IPSec based VPN using Openswan - IP confusion

Most of your answers can be found here: http://linux.die.net/man/5/ipsec.conf To speak through them however: left will specify the IP address of the left peer, as it is seen from the right peer. ...
Eddie's user avatar
  • 14.5k
7 votes
Accepted

IPSec failure with `IKE message failed its sanity check or is malformed`

Answering my own question: the solution was: Use the correct group name in the client config (VPN_CLIENTS in example) Use the group's key (secret3) in the client, not the main key (secret2) (latter ...
jonathanjo's user avatar
  • 16.1k
6 votes

Confused on perfect forward secrecy, someone kindly help me

The link you provided was broken, so I couldn't validate the context. But, as I contributed to the other thread, I might be in a good place to help contribute to this =). At the end of ISAKMP (Phase ...
Eddie's user avatar
  • 14.5k
6 votes

MTU/MSS Oddness?

Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately). https://cway.cisco.com/ipsec-overhead-calculator/ From where we can draw, based on your IPSec settings and a few common ...
Marc 'netztier' Luethi's user avatar
6 votes

Is it possible to implement IPSEC over MPLS?

If your MPLS L3VPN supports IP transport from endpoint A to/from endpoint B at the other site (which is their primary purpose), there's nothing to stop you from letting A and B talk IPSec (in one or ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

1 What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied: At your ...
Hung Tran's user avatar
  • 3,754
5 votes
Accepted

How to keep an ASA tunnel up for lifetime?

You should be able to disable this in the group policy attributes. group-policy "policy_name" attributes vpn-idle-timeout none
A-A-Ron's user avatar
  • 536
5 votes
Accepted

IPSec site-to-site with/without NAT

If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel. If you want the 11.11....
Eddie's user avatar
  • 14.5k
5 votes
Accepted

Use cases for GRE over IPSEC

Running multicast or multicast based routing protocols does not necessarily require GRE-over-IPsec. "Tunnel based" or "route based" VPN (tunnel mode ipsec ipv4 a.k.a. IPsec Virtual Tunnel Interfaces ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

How IPsec tunnel mode work without GRE

So what's the difference between GRE+IPsec and IPsec only? In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet. The ...
Ron Trunk's user avatar
  • 66.1k
5 votes

Is Cisco IPsec different from ordinary IPsec?

Both Windows L2TP/IPsec and Cisco IPsec are different from ordinary IPsec. Originally the "ordinary" IPsec handshake protocol (IKEv1) did not have any features to negotiate the client's VPN ...
user1686's user avatar
  • 309
5 votes

What's the advantage of IPSec over TLS/DTLS?

At a high level, they are equivalent. They are both "Secure Communication" protocols which create a "tunnel" between two end points. Data transferred within this tunnel is ...
Eddie's user avatar
  • 14.5k
4 votes

IPsec tunnel configuration question

Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1 I will ...
lidocaineus's user avatar
4 votes

Will an asa pass traffic that matches a crypto map entry if Phase 2 is not completed?

If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up). If the build attempt fails, no traffic will make it to the outside interface.
Eddie's user avatar
  • 14.5k
4 votes
Accepted

Deploying an IPSEC secure-channel - isakmp SA empty

If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers. In this case there are several problems in your configuration as far as I can ...
0xc3faadd3's user avatar
4 votes

Fortigate "remembers" bad routes

First off, this behavior is as expected. The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and ...
user1016274's user avatar
4 votes
Accepted

High number of "pkts replay failed" on Cisco ASA

This happens occasionally when you have a very busy VPN tunnel (>200 packets per second). To understand why, you have to first understand what Anti-Replay is doing. Anti-Replay The goal of Anti-...
Eddie's user avatar
  • 14.5k
4 votes
Accepted

Does any router support line-speed throughput for a single IPSec tunnel?

Yes. The Cisco ASR 1001-HX is one that is advertised to do it. Just step through 2 clicks of Cisco's router selector and see all the boxes that do 10G+ of IPSec.
Ronnie Royston's user avatar
4 votes

How to check if IPSec is available on Cisco ISR 4451

On the router console, type show version If the image name includes the letters "K9", as in C3000-UNIVERSALK9-M, then yes. Otherwise, no. You can also type a command like show crypto isakmp sa ...
Ron Trunk's user avatar
  • 66.1k
4 votes
Accepted

How to check if IPSec is available on Cisco ISR 4451

Check your license boot: show run | include boot And if you don't see it there already, add it like this: license boot level appxk9 *edit: in your case, you need license boot level securityk9 After ...
thorr18's user avatar
  • 208
4 votes
Accepted

Cisco ASA single isakmp policy for multiple crypto map

The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and ...
Hung Tran's user avatar
  • 3,754
4 votes
Accepted

ASA IPsec Removing peer from correlator table failed, no match

With access-list ACL-VPN-SITE-1, you can have mullple lines for different subnets at Site-1. If you would like to have a single-line access-list, you need to put all subnets (for VPN traffic) at Site-...
Hung Tran's user avatar
  • 3,754
4 votes
Accepted

How are VPN Clients given IP addresses when they connect to VPN Routers such as VyOS? (How do Virtual IP Address Pools fit in?)

DHCP requires a link layer which doesn't really exist for VPN clients. Usually, a routed VPN connection is used and the VIPAP pool is used instead of the non-existent DHCP pool. With a bridged VPN ...
Zac67's user avatar
  • 79.8k
4 votes
Accepted

IPSec route-based vpn st0 interface

Traffic will still flow between A and D if you set the next-hop of B or C instead of st0.0 (assuming there are no NAT or security policy issues) however you will no longer be routing through the ...
Benjamin Dale's user avatar
4 votes
Accepted

Keep Cisco site-to-site tunnel up permanently

Your options are: The IP SLA Always be sending something over the tunnel from host/server to host/server to keep the tunnel up (effectively just another form of an IP SLA) Configure the lifetimes on ...
Jesse P.'s user avatar
  • 4,670
4 votes
Accepted

MAC Address not resolving when IPSec VPN in place

MAC addresses are only seen or relevant on the local network. Routers strip off the layer-2 frames, losing the original MAC addresses, in order to route the packets. Routers will then build new frames ...
Ron Maupin's user avatar
  • 97.7k
4 votes

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

SCEP (https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) is another protocol to get CSRs from and certificates back to a large number of devices - provided they can generate their ...
Marc 'netztier' Luethi's user avatar
4 votes
Accepted

MTU/MSS Oddness?

REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved. The MTU information helped guide us down a ...
Thomas Ward's user avatar
3 votes
Accepted

IOS to ASA dynamic and static VPNs - sharing same crypto ACL?

When the ASA attempts to send traffic out an interface where a crypto map is applied, it will always process the crypto map from top-down, looking for the first match. Therefore, it will always match ...
user3629081's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible