Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Hot answers tagged

16 votes
Accepted

In IPsec VPN, how is the pre-shared key encrypted?

You've asked a great question. The question seems very simple, but in fact the answer is somewhat more complex. I'll do my best to answer it in a succinct manner. Also, since you mentioned ISAKMP, ...
user avatar
  • 13.9k
7 votes

IPSec based VPN using Openswan - IP confusion

Most of your answers can be found here: http://linux.die.net/man/5/ipsec.conf To speak through them however: left will specify the IP address of the left peer, as it is seen from the right peer. ...
user avatar
  • 13.9k
7 votes
Accepted

IPSec failure with `IKE message failed its sanity check or is malformed`

Answering my own question: the solution was: Use the correct group name in the client config (VPN_CLIENTS in example) Use the group's key (secret3) in the client, not the main key (secret2) (latter ...
user avatar
  • 15.9k
6 votes
Accepted

Cisco IPSEC VPN fail Stage 2

Access lists aren't a problem here. The output from show cypro isakmp sa tells you that the key negotiation is failing (MM_NO_STATE). The log entry says that the hub wants to use a transform set (...
user avatar
  • 62.1k
6 votes
Accepted

Can we change peer IP of IPSec VPN tunnel in one line?

Can I change that simply by typing the following in conf t: In your example, issuing crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3 will append 0.9.8.7 6.5.4.3 to your existing peer list for ...
user avatar
  • 1,626
6 votes

Confused on perfect forward secrecy, someone kindly help me

The link you provided was broken, so I couldn't validate the context. But, as I contributed to the other thread, I might be in a good place to help contribute to this =). At the end of ISAKMP (Phase ...
user avatar
  • 13.9k
6 votes

MTU/MSS Oddness?

Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately). https://cway.cisco.com/ipsec-overhead-calculator/ From where we can draw, based on your IPSec settings and a few common ...
user avatar
6 votes

Is it possible to implement IPSEC over MPLS?

If your MPLS L3VPN supports IP transport from endpoint A to/from endpoint B at the other site (which is their primary purpose), there's nothing to stop you from letting A and B talk IPSec (in one or ...
user avatar
5 votes

In IPsec VPN, how is the pre-shared key encrypted?

Your answer is in your question: The Diffie-Hellman exchange is used to generate a common key to securely exchange a common key (i.e. pre-share). See this: https://security.stackexchange.com/...
user avatar
  • 62.1k
5 votes
Accepted

After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel

Yes, the device can be instructed to accept the client VPN connections from the peer that it already has an open tunnel with. This is done by updating the dynamic map to include new entries with a ...
user avatar
5 votes
Accepted

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

1 What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied: At your ...
user avatar
  • 3,744
5 votes
Accepted

How to keep an ASA tunnel up for lifetime?

You should be able to disable this in the group policy attributes. group-policy "policy_name" attributes vpn-idle-timeout none
user avatar
  • 536
5 votes
Accepted

IPSec site-to-site with/without NAT

If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel. If you want the 11.11....
user avatar
  • 13.9k
5 votes
Accepted

Use cases for GRE over IPSEC

Running multicast or multicast based routing protocols does not necessarily require GRE-over-IPsec. "Tunnel based" or "route based" VPN (tunnel mode ipsec ipv4 a.k.a. IPsec Virtual Tunnel Interfaces ...
user avatar
5 votes
Accepted

How IPsec tunnel mode work without GRE

So what's the difference between GRE+IPsec and IPsec only? In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet. The ...
user avatar
  • 62.1k
5 votes

Is Cisco IPsec different from ordinary IPsec?

Both Windows L2TP/IPsec and Cisco IPsec are different from ordinary IPsec. Originally the "ordinary" IPsec handshake protocol (IKEv1) did not have any features to negotiate the client's VPN ...
user avatar
  • 259
4 votes
Accepted

IPsec, how to differentiate TCP and UDP

Assuming you mean to protect confidentiality of the communication at IP layer with IPsec: How would the underlying network be able to differentiate between UDP and TCP since they're at the ...
user avatar
4 votes

Why do multi-line crypto ACL's create instability in VPN tunnels?

If you're talking Cisco, each acl record is it's own SA (tunnel). FWIW, the Cisco PIX/ASA will not allow an "any" rule. (which is why an IOS tunnel interface cannot terminate to a PIX/ASA.) What ...
user avatar
  • 29.5k
4 votes
Accepted

Deploying an IPSEC secure-channel - isakmp SA empty

If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers. In this case there are several problems in your configuration as far as I can ...
user avatar
4 votes
Accepted

Cisco ASA 5520 - Create local VPN pool

ASA VPN address pools can be a /22 (or larger) and function correctly. The limitation of how many of those addresses can actually be active at any one time is based on the hardware in use. The 5520 ...
user avatar
  • 1,470
4 votes
Accepted

Have Cisco ASA 5505 and want it to maintain site-to-site VPN connections

If you want to keep the ASA for the L2L tunnels you could assign a second public IP to the new firewall and not modify the ASA. Then set your default route to the new firewall and add routes for the ...
user avatar
4 votes

Will an asa pass traffic that matches a crypto map entry if Phase 2 is not completed?

If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up). If the build attempt fails, no traffic will make it to the outside interface.
user avatar
  • 13.9k
4 votes

IPsec tunnel configuration question

Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1 I will ...
user avatar
4 votes

Fortigate "remembers" bad routes

First off, this behavior is as expected. The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and ...
user avatar
4 votes
Accepted

High number of "pkts replay failed" on Cisco ASA

This happens occasionally when you have a very busy VPN tunnel (>200 packets per second). To understand why, you have to first understand what Anti-Replay is doing. Anti-Replay The goal of Anti-...
user avatar
  • 13.9k
4 votes
Accepted

Does any router support line-speed throughput for a single IPSec tunnel?

Yes. The Cisco ASR 1001-HX is one that is advertised to do it. Just step through 2 clicks of Cisco's router selector and see all the boxes that do 10G+ of IPSec.
user avatar
4 votes

How to check if IPSec is available on Cisco ISR 4451

On the router console, type show version If the image name includes the letters "K9", as in C3000-UNIVERSALK9-M, then yes. Otherwise, no. You can also type a command like show crypto isakmp sa ...
user avatar
  • 62.1k
4 votes
Accepted

How to check if IPSec is available on Cisco ISR 4451

Check your license boot: show run | include boot And if you don't see it there already, add it like this: license boot level appxk9 *edit: in your case, you need license boot level securityk9 After ...
user avatar
  • 208
4 votes
Accepted

Cisco ASA single isakmp policy for multiple crypto map

The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and ...
user avatar
  • 3,744

Only top scored, non community-wiki answers of a minimum length are eligible