7
votes
IPSec based VPN using Openswan - IP confusion
Most of your answers can be found here:
http://linux.die.net/man/5/ipsec.conf
To speak through them however:
left will specify the IP address of the left peer, as it is seen from the right peer. ...
- 14.5k
7
votes
Accepted
IPSec failure with `IKE message failed its sanity check or is malformed`
Answering my own question: the solution was:
Use the correct group name in the client config (VPN_CLIENTS in example)
Use the group's key (secret3) in the client, not the main key (secret2) (latter ...
- 16.1k
6
votes
Confused on perfect forward secrecy, someone kindly help me
The link you provided was broken, so I couldn't validate the context.
But, as I contributed to the other thread, I might be in a good place to help contribute to this =).
At the end of ISAKMP (Phase ...
- 14.5k
6
votes
MTU/MSS Oddness?
Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately).
https://cway.cisco.com/ipsec-overhead-calculator/
From where we can draw, based on your IPSec settings and a few common ...
- 8,410
6
votes
Is it possible to implement IPSEC over MPLS?
If your MPLS L3VPN supports IP transport from endpoint A to/from endpoint B at the other site (which is their primary purpose), there's nothing to stop you from letting A and B talk IPSec (in one or ...
- 8,410
5
votes
Accepted
Site-to-Site IPsec VPN tunnel with an additional remote network/subnet
1
What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied:
At your ...
- 3,754
5
votes
Accepted
How to keep an ASA tunnel up for lifetime?
You should be able to disable this in the group policy attributes.
group-policy "policy_name" attributes
vpn-idle-timeout none
- 536
5
votes
Accepted
IPSec site-to-site with/without NAT
If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel.
If you want the 11.11....
- 14.5k
5
votes
Accepted
Use cases for GRE over IPSEC
Running multicast or multicast based routing protocols does not necessarily require GRE-over-IPsec. "Tunnel based" or "route based" VPN (tunnel mode ipsec ipv4 a.k.a. IPsec Virtual Tunnel Interfaces ...
- 8,410
5
votes
Accepted
How IPsec tunnel mode work without GRE
So what's the difference between GRE+IPsec and IPsec only?
In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet.
The ...
- 66.1k
5
votes
Is Cisco IPsec different from ordinary IPsec?
Both Windows L2TP/IPsec and Cisco IPsec are different from ordinary IPsec.
Originally the "ordinary" IPsec handshake protocol (IKEv1) did not have any features to negotiate the client's VPN ...
- 309
5
votes
What's the advantage of IPSec over TLS/DTLS?
At a high level, they are equivalent. They are both "Secure Communication" protocols which create a "tunnel" between two end points. Data transferred within this tunnel is ...
- 14.5k
4
votes
IPsec tunnel configuration question
Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1
I will ...
- 141
4
votes
Will an asa pass traffic that matches a crypto map entry if Phase 2 is not completed?
If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up). If the build attempt fails, no traffic will make it to the outside interface.
- 14.5k
4
votes
Accepted
Deploying an IPSEC secure-channel - isakmp SA empty
If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers.
In this case there are several problems in your configuration as far as I can ...
- 56
4
votes
Fortigate "remembers" bad routes
First off, this behavior is as expected.
The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and ...
- 880
4
votes
Accepted
High number of "pkts replay failed" on Cisco ASA
This happens occasionally when you have a very busy VPN tunnel (>200 packets per second). To understand why, you have to first understand what Anti-Replay is doing.
Anti-Replay
The goal of Anti-...
- 14.5k
4
votes
Accepted
Does any router support line-speed throughput for a single IPSec tunnel?
Yes. The Cisco ASR 1001-HX is one that is advertised to do it. Just step through 2 clicks of Cisco's router selector and see all the boxes that do 10G+ of IPSec.
- 4,349
4
votes
How to check if IPSec is available on Cisco ISR 4451
On the router console, type
show version
If the image name includes the letters "K9", as in C3000-UNIVERSALK9-M, then yes. Otherwise, no.
You can also type a command like
show crypto isakmp sa
...
- 66.1k
4
votes
Accepted
How to check if IPSec is available on Cisco ISR 4451
Check your license boot:
show run | include boot
And if you don't see it there already, add it like this:
license boot level appxk9
*edit: in your case, you need license boot level securityk9
After ...
- 208
4
votes
Accepted
Cisco ASA single isakmp policy for multiple crypto map
The answer is: No, you (do not need to) cannot create seperate (same/duplicate) isakmp policies for different tunnels which have the same isakmp policy setups. That means if you have only single and ...
- 3,754
4
votes
Accepted
ASA IPsec Removing peer from correlator table failed, no match
With access-list ACL-VPN-SITE-1, you can have mullple lines for different subnets at Site-1.
If you would like to have a single-line access-list, you need to put all subnets (for VPN traffic) at Site-...
- 3,754
4
votes
Accepted
How are VPN Clients given IP addresses when they connect to VPN Routers such as VyOS? (How do Virtual IP Address Pools fit in?)
DHCP requires a link layer which doesn't really exist for VPN clients. Usually, a routed VPN connection is used and the VIPAP pool is used instead of the non-existent DHCP pool.
With a bridged VPN ...
- 79.8k
4
votes
Accepted
IPSec route-based vpn st0 interface
Traffic will still flow between A and D if you set the next-hop of B or C instead of st0.0 (assuming there are no NAT or security policy issues) however you will no longer be routing through the ...
- 9,156
4
votes
Accepted
Keep Cisco site-to-site tunnel up permanently
Your options are:
The IP SLA
Always be sending something over the tunnel from host/server to host/server to keep the tunnel up (effectively just another form of an IP SLA)
Configure the lifetimes on ...
- 4,670
4
votes
Accepted
MAC Address not resolving when IPSec VPN in place
MAC addresses are only seen or relevant on the local network. Routers strip off the layer-2 frames, losing the original MAC addresses, in order to route the packets. Routers will then build new frames ...
- 97.7k
4
votes
Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?
SCEP (https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) is another protocol to get CSRs from and certificates back to a large number of devices - provided they can generate their ...
- 8,410
4
votes
Accepted
MTU/MSS Oddness?
REALLY REALLY late update, but I got busy with other tasks (MS365 migrations, recent software vulnerabilities, etc.), so whoops that i left this unsolved.
The MTU information helped guide us down a ...
- 181
3
votes
Accepted
IOS to ASA dynamic and static VPNs - sharing same crypto ACL?
When the ASA attempts to send traffic out an interface where a crypto map is applied, it will always process the crypto map from top-down, looking for the first match. Therefore, it will always match ...
- 971
Only top scored, non community-wiki answers of a minimum length are eligible