Skip to main content
Share Your Experience: Take the 2024 Developer Survey
7 votes
Accepted

IPSec failure with `IKE message failed its sanity check or is malformed`

Answering my own question: the solution was: Use the correct group name in the client config (VPN_CLIENTS in example) Use the group's key (secret3) in the client, not the main key (secret2) (latter ...
jonathanjo's user avatar
  • 16.3k
6 votes

Confused on perfect forward secrecy, someone kindly help me

The link you provided was broken, so I couldn't validate the context. But, as I contributed to the other thread, I might be in a good place to help contribute to this =). At the end of ISAKMP (Phase ...
Eddie's user avatar
  • 15k
6 votes

MTU/MSS Oddness?

Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately). https://cway.cisco.com/ipsec-overhead-calculator/ From where we can draw, based on your IPSec settings and a few common ...
Marc 'netztier' Luethi's user avatar
6 votes

What's the advantage of IPSec over TLS/DTLS?

At a high level, they are equivalent. They are both "Secure Communication" protocols which create a "tunnel" between two end points. Data transferred within this tunnel is ...
Eddie's user avatar
  • 15k
6 votes

Is it possible to implement IPSEC over MPLS?

If your MPLS L3VPN supports IP transport from endpoint A to/from endpoint B at the other site (which is their primary purpose), there's nothing to stop you from letting A and B talk IPSec (in one or ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

Site-to-Site IPsec VPN tunnel with an additional remote network/subnet

1 What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied: At your ...
Hung Tran's user avatar
  • 3,754
5 votes
Accepted

How to keep an ASA tunnel up for lifetime?

You should be able to disable this in the group policy attributes. group-policy "policy_name" attributes vpn-idle-timeout none
A-A-Ron's user avatar
  • 636
5 votes
Accepted

IPSec site-to-site with/without NAT

If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel. If you want the 11.11....
Eddie's user avatar
  • 15k
5 votes
Accepted

Use cases for GRE over IPSEC

Running multicast or multicast based routing protocols does not necessarily require GRE-over-IPsec. "Tunnel based" or "route based" VPN (tunnel mode ipsec ipv4 a.k.a. IPsec Virtual Tunnel Interfaces ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

How IPsec tunnel mode work without GRE

So what's the difference between GRE+IPsec and IPsec only? In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet. The ...
Ron Trunk's user avatar
  • 67.6k
5 votes

Is Cisco IPsec different from ordinary IPsec?

Both Windows L2TP/IPsec and Cisco IPsec are different from ordinary IPsec. Originally the "ordinary" IPsec handshake protocol (IKEv1) did not have any features to negotiate the client's VPN ...
u1686_grawity's user avatar
4 votes

IPsec tunnel configuration question

Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1 I will ...
lidocaineus's user avatar
4 votes
Accepted

Deploying an IPSEC secure-channel - isakmp SA empty

If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers. In this case there are several problems in your configuration as far as I can ...
0xc3faadd3's user avatar
4 votes
Accepted

Does any router support line-speed throughput for a single IPSec tunnel?

Yes. The Cisco ASR 1001-HX is one that is advertised to do it. Just step through 2 clicks of Cisco's router selector and see all the boxes that do 10G+ of IPSec.
Ronnie Royston's user avatar
4 votes

How to check if IPSec is available on Cisco ISR 4451

On the router console, type show version If the image name includes the letters "K9", as in C3000-UNIVERSALK9-M, then yes. Otherwise, no. You can also type a command like show crypto isakmp sa ...
Ron Trunk's user avatar
  • 67.6k
4 votes
Accepted

How to check if IPSec is available on Cisco ISR 4451

Check your license boot: show run | include boot And if you don't see it there already, add it like this: license boot level appxk9 *edit: in your case, you need license boot level securityk9 After ...
thorr18's user avatar
  • 208
4 votes
Accepted

Cisco ASA single isakmp policy for multiple crypto map

The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and ...
Hung Tran's user avatar
  • 3,754
4 votes
Accepted

ASA IPsec Removing peer from correlator table failed, no match

With access-list ACL-VPN-SITE-1, you can have mullple lines for different subnets at Site-1. If you would like to have a single-line access-list, you need to put all subnets (for VPN traffic) at Site-...
Hung Tran's user avatar
  • 3,754
4 votes
Accepted

How are VPN Clients given IP addresses when they connect to VPN Routers such as VyOS? (How do Virtual IP Address Pools fit in?)

DHCP requires a link layer which doesn't really exist for VPN clients. Usually, a routed VPN connection is used and the VIPAP pool is used instead of the non-existent DHCP pool. With a bridged VPN ...
Zac67's user avatar
  • 84.8k
4 votes
Accepted

IPSec route-based vpn st0 interface

Traffic will still flow between A and D if you set the next-hop of B or C instead of st0.0 (assuming there are no NAT or security policy issues) however you will no longer be routing through the ...
Benjamin Dale's user avatar
4 votes
Accepted

Keep Cisco site-to-site tunnel up permanently

Your options are: The IP SLA Always be sending something over the tunnel from host/server to host/server to keep the tunnel up (effectively just another form of an IP SLA) Configure the lifetimes on ...
Jesse P.'s user avatar
  • 4,690
4 votes
Accepted

MAC Address not resolving when IPSec VPN in place

MAC addresses are only seen or relevant on the local network. Routers strip off the layer-2 frames, losing the original MAC addresses, in order to route the packets. Routers will then build new frames ...
Ron Maupin's user avatar
  • 99.8k
4 votes

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

SCEP (https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) is another protocol to get CSRs from and certificates back to a large number of devices - provided they can generate their ...
Marc 'netztier' Luethi's user avatar
4 votes
Accepted

MTU/MSS Oddness?

REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved. The MTU information helped guide us down a ...
Thomas Ward's user avatar
4 votes
Accepted

Why does IKEv2 forbid dynamic address updates for hosts behind NAT?

Read the entire paragraph. They're talking about how to handle a dynamic address changing mid-connection, which could be due to a NAT timeout, NAT table reset ("reboot"), or the node simply ...
Ricky's user avatar
  • 32.2k
3 votes
Accepted

ASA tunnel up but not passing traffic

Your scenario looks very similar to something you'll see if you have a stale SPI on your ASA that is "trumping" the valid active SPI. The bad news is, if this is the case...you can only correct this ...
Nick Roberts's user avatar
3 votes

Understanding the PDU at router when using Tunneling

It's quite obvious. For inbound traffic, the packet analyzer shows you already decapsulated traffic. That's why you're seeing real IPs in the header, so essentially it's already decrypted. For ...
Łukasz Bromirski's user avatar
3 votes
Accepted

ipsec balancing with multihomed setup

Yes you can do this. As @RickyBeam so loquaciously points out ;-), you can configure routers on both sides to use a routing protocol (OSPF for example) that allows Equal Cost Multi-Path. Each router ...
Ron Trunk's user avatar
  • 67.6k
3 votes
Accepted

IOS to ASA dynamic and static VPNs - sharing same crypto ACL?

When the ASA attempts to send traffic out an interface where a crypto map is applied, it will always process the crypto map from top-down, looking for the first match. Therefore, it will always match ...
user3629081's user avatar
  • 1,008

Only top scored, non community-wiki answers of a minimum length are eligible