Hot answers tagged

16

I have been confused by this in the past, so I've tried to break it out for you below. Phase I Lifetime: Phase I lifetime on Cisco IOS routers is managed by the global ISAKMP Policy. However this is not a mandatory field, if you do not enter a value, the router will default to 86400 seconds. crypto isakmp policy 1 lifetime <value> To verify the ...


16

You've asked a great question. The question seems very simple, but in fact the answer is somewhat more complex. I'll do my best to answer it in a succinct manner. Also, since you mentioned ISAKMP, I am going to assume you are interested in IKEv1. Things change a little for IKEv2 (well, a lot), but I did want to mention the answer below only correlates to ...


8

Sure, it's certainly possible. Basically, you'll need to setup a crypto map to catch and encrypt the L2TP traffic. The psuedowire\L2TP config can be attached to a Virtual-PPP interface. Here's a config snippet that should get you going. ! Basic ISAKMP\IPSec configuration, tweak as needed. ! crypto isakmp policy 10 encr 3des authentication pre-share ...


7

I see traffic on both the tunnel and the physical interface. Why is that? The tunnel is virtual between two routers, but it is still leaving a physical interface; that means the counters on the physical interface will increase. The IPSec/GRE tunnel has to go somewhere.


7

Answering my own question: the solution was: Use the correct group name in the client config (VPN_CLIENTS in example) Use the group's key (secret3) in the client, not the main key (secret2) (latter appears to be extraneous, comment welcome) Use less noisy debugging (debug crypto ipsec) to identify hash and transform incompatibilities Get the exact right ...


6

Access lists aren't a problem here. The output from show cypro isakmp sa tells you that the key negotiation is failing (MM_NO_STATE). The log entry says that the hub wants to use a transform set (esp-aes, esp-sha-hmac) that you don't support. None of the transform sets on your router include esp-aes, esp-sha-hmac. I suggest you add that to your list of ...


6

Can I change that simply by typing the following in conf t: In your example, issuing crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3 will append 0.9.8.7 6.5.4.3 to your existing peer list for Outside_map's sequence number 10. The peer list can hold up to ten addresses. ASA3(config)# show run crypto | i peer crypto map Outside_map 10 set peer 1.2.3.4 5.6....


6

Most of your answers can be found here: http://linux.die.net/man/5/ipsec.conf To speak through them however: left will specify the IP address of the left peer, as it is seen from the right peer. Typically, this public IP address of the left peer. leftsubnet will specify the IP subnet for the left subnet. In the end, the IPsec SA (secure data channel) will ...


6

The link you provided was broken, so I couldn't validate the context. But, as I contributed to the other thread, I might be in a good place to help contribute to this =). At the end of ISAKMP (Phase 1), three keys exist: Derivative Key -- this key is not used by ISAKMP, and is instead handed to IPsec so that IPsec can create its own Secret Keys ...


5

One solution is to use Performance routing (PfR) on the gateway routers. PfR can test connectivity to each data center and then route traffic to whichever one is responding. So if a tunnel goes down, PfR will automatically route traffic through the other tunnel to the other data center. PfR can do this by pinging (or using IP SLA) each of the data ...


5

I found the answer, Dynamic Crypto Maps with IPv6 are NOT SUPPORTED by Cisco IOS 15.2


5

Your answer is in your question: The Diffie-Hellman exchange is used to generate a common key to securely exchange a common key (i.e. pre-share). See this: https://security.stackexchange.com/questions/67953/understanding-diffie-hellman-key-exchange


5

Yes, the device can be instructed to accept the client VPN connections from the peer that it already has an open tunnel with. This is done by updating the dynamic map to include new entries with a configured peer address. So, with this existing configuration accepting a dynamic connection from any address: crypto map vpnmap 10 match address peer_acl ...


5

1 What you did is NOT enough. You have to ensure VPN configuration is updated for the additional subnet (172.20.0.0/16) at BOTH ends. To be specific, the following points need to be satisfied: At your end: Add Crypto ACL for additional subnet. You already did this. Add Interface ACL for additional subnet. I do not see rules for 172.16.0.0/16 in your ...


5

You should be able to disable this in the group policy attributes. group-policy "policy_name" attributes vpn-idle-timeout none


5

If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel. If you want the 11.11.0.0/16 network to speak directly to the 10.1.1.0/24 network, then you don't need any type of NAT. If you want the 11.11.0.0/16 network to speak to another ...


5

Running multicast or multicast based routing protocols does not necessarily require GRE-over-IPsec. "Tunnel based" or "route based" VPN (tunnel mode ipsec ipv4 a.k.a. IPsec Virtual Tunnel Interfaces in cisco lingo) will transport multicast and EIGRP or OSPF happily. However, GRE is needed when you need to run non-IP protocols across IPSec: At my former ...


5

So what's the difference between GRE+IPsec and IPsec only? In GRE+IPsec the original IP packet is encapsulated in a GRE tunnel packet. The GRE packet is then encapsulated in the IPSec packet. The most common reason for doing this is to allow broadcast and multicast across the tunnel. Neither is supported by IPSec alone. GRE can also encapsulate non-IP ...


5

Both Windows L2TP/IPsec and Cisco IPsec are different from ordinary IPsec. Originally the "ordinary" IPsec handshake protocol (IKEv1) did not have any features to negotiate the client's VPN address, or to push parameters such as split-tunnel routes & DNS servers. In other words, you could use it to manually create static tunnels, but it lacked the ...


5

Cisco has a nice IPSec Overhead calculator (CCO Login required, unfortunately). https://cway.cisco.com/ipsec-overhead-calculator/ From where we can draw, based on your IPSec settings and a few common optionals thrown in: 8 PPPoE (optional, but widespread) 20 outer IP header 8 NAT-T (optional, widespread, sometimes even default-on) 8 ESP Header (4 SPI ...


4

To configure IPSec with the native Windows7 client, you need L2TP + IPSec on IOS and Windows 7 L2TP + IPSec.


4

IPSEC has no ports. In IPv4 IPSEC, or to be more precise AH (authentication header) and ESP (encapsulation security payload), are two IP protocols just like TCP and UDP. In IPv6 IPSEC is part of the protocol are there are two extension headers one for authentication and one for encryption. The only thing that has something to do with ports is IKE (Internet ...


4

Assuming you mean to protect confidentiality of the communication at IP layer with IPsec: How would the underlying network be able to differentiate between UDP and TCP since they're at the transport layer. The next header field of the ESP header tells you the type of payload. If you use tunnel mode (which is custom for VPNs), then without the ...


4

If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site tunnel between the two routers. In this case there are several problems in your configuration as far as I can tell: First of all - you need to establish a GRE (Unencrypted) tunnel between the two routers like so: Router A: interface Tunnel100 tunnel source ...


4

If you're talking Cisco, each acl record is it's own SA (tunnel). FWIW, the Cisco PIX/ASA will not allow an "any" rule. (which is why an IOS tunnel interface cannot terminate to a PIX/ASA.) What sort of instability are you seeing? If one rule works, they should all work. Yes, there will be a delay if the SA isn't setup yet. The only issue I can think of ...


4

If you want to keep the ASA for the L2L tunnels you could assign a second public IP to the new firewall and not modify the ASA. Then set your default route to the new firewall and add routes for the L2L traffic to go to the ASA. Though the easiest way would be to recover the VPN config off the ASA and use a single device. You can view the pre shared keys ...


4

ASA VPN address pools can be a /22 (or larger) and function correctly. The limitation of how many of those addresses can actually be active at any one time is based on the hardware in use. The 5520 supports up to 750 concurrent VPN peers per the datasheet.


4

If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up). If the build attempt fails, no traffic will make it to the outside interface.


4

Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1 I will answer similarly: what you're doing is VPN concentration. There are various vendor-specific ways to do this, some very straightforward, some extremely esoteric, but ...


4

First off, this behavior is as expected. The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and whether forwarding is permitted or not. After these decisions, subsequent traffic belonging to the same session is forwarded without any further decisions to make. ...


Only top voted, non community-wiki answers of a minimum length are eligible