36
The reasoning behind your current setup is probably some combination of the following three reasons.
The VPN is a security solution for outside your company's network (See #1 below). SSH however, might be a second layer of security outside of your company's network... but its main purpose is to secure the traffic within your company's network (See #2 Below)....
22
SSH is an extremely popular target for brute-forcing attempts. If you have an SSH server directly on the Internet, within minutes, you will see login attempts with all kinds of user names (and passwords) - often thousands per day even on small insignificant servers.
Now it is possible to harden SSH servers (the main three mechanisms are requiring an SSH key,...
16
I have been confused by this in the past, so I've tried to break it out for you below.
Phase I Lifetime:
Phase I lifetime on Cisco IOS routers is managed by the global ISAKMP Policy. However this is not a mandatory field, if you do not enter a value, the router will default to 86400 seconds.
crypto isakmp policy 1
lifetime <value>
To verify the ...
16
You've asked a great question. The question seems very simple, but in fact the answer is somewhat more complex. I'll do my best to answer it in a succinct manner. Also, since you mentioned ISAKMP, I am going to assume you are interested in IKEv1. Things change a little for IKEv2 (well, a lot), but I did want to mention the answer below only correlates to ...
15
First of all, T1 gives you around 1.5Mbit/s in both directions, not 3Mbit/s. If you're seeing 3Mbit/s, it may be bundled from two separate lines.
Now, for VPN, if that's IP-based VPN as 99% of VPNs currently are, of course it doesn't matter if your physical interface is T1, E1, ATM OC-3 or 10GE WAN PHY - it's just used to provide higher-layer connectivity - ...
12
L2VPN is generic term for group of technologies out of which one is VPLS, but could be number of other technologies such as emerging EVPN.
For more information read WG charter/mailing lists as L2VPN has lot of active work going on. Also read RFC6624 and RFC4761
11
Some VPNs push the default gateway (a /0 netmask) as two /1 networks: 0/1 and 128/1. Since a more specific route always wins, this forces traffic to be routed via the VPN instead of over the default gateway.
10
I just came across a new way that I was never aware of before and offers the same information you find in the ASDM interface, including the feature to logoff a vpn session.
Issue this for example to get a list of site to site vpn tunnels that are up.
show vpn-sessiondb l2l
output example:
Connection : 192.168.1.1
Index : 330 ...
10
There is no technical reason for requiring a leased line or similar for the VPN if another (cheaper) option is adequately fast and sufficiency low latency.
It may be that the leased line comes with significant service level agreements (with refunds/other built in to the contract for if the service fails to achieve these levels of availability/speed/latency/...
8
Sure, it's certainly possible. Basically, you'll need to setup a crypto map to catch and encrypt the L2TP traffic. The psuedowire\L2TP config can be attached to a Virtual-PPP interface. Here's a config snippet that should get you going.
! Basic ISAKMP\IPSec configuration, tweak as needed.
!
crypto isakmp policy 10
encr 3des
authentication pre-share
...
8
Junos does have DPD and you can use it in conjunction with multiple endpoint IP addresses in a single IKE tunnel.
There is a bit of info about it here (which I've copied below)
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29211&actp=RSS
SUMMARY:
This article explains how redundancy in site-to-site VPN can be achieved using multiple ...
8
The most and noticeable different is layer of tunneling. PPPOE is a Layer 2 (Data Link Layer) tunneling protocol while L2TP is a Layer 3 (Network Layer) tunneling protocol. This means that PPPOE can create a tunnel between devices in a broadcast domain (such as devices connect to the same switch) but L2TP can create a tunnel between two IP-based device ...
8
Originally, WANs were mostly defined by specific layer 1/2 protocols (Frame Relay, HDLC, SONET, etc) that they used, but Ethernet has taken over, and the others are rapidly fading into history. The term "WAN" now generally describes a network that covers some larger geographical area than a LAN. Sounds vague? It is.
Some WANs, like the Internet are public,...
8
There are layer-2 and layer-3 VPNs. "VPN" is a term used for a tunnel combined with encryption.
A tunneling interface encapsulates an inner packet (or frame) in an outer packet. This inner packet is then transported to the far tunnel end, according to the outer packet, and decapsulated again. For the inner packet the tunnel looks like a direct ...
7
The only way to properly do this, if their IP HAS to be the same as their desktop, is for them to RDP onto their desktop over the VPN.
Or fix the software that's got this ludicrous requirement
7
They originate on the outside interface. This is one of my NAT entries for an international site connected via L2L:
nat (inside-office,ISPA) source static Corporate Corporate destination static France France no-proxy-arp route-lookup
ISPA -> translates to outside for most people, 0 security interface
Corporate -> object-group network containing the local/...
7
ASA crypto map ACLs do not support protocol traffic matching (yeah, I know). The crypto map ACL should match on network, and then either use the global no sysopt connection permit-vpn to apply the interface ACL to tunneled traffic (not recommended) or use a vpn-filter in your tunnel group policy to restrict traffic by protocol.
Even if the ASA did allow the ...
7
If I increase the MTU over 1500 to 9000 for OpenVPN when connecting to a remote server over the internet, I'll have fragmentation and won't gain any performance due to the fact that I don't know if the routers that handle my packets support jumboframes?
Many providers still use 1500 byte IP MTUs; you cannot depend on anything larger. It is very unlikely ...
7
Experiment
There is a lot of conflicting information about what actually happens on a Windows client when using split-dns. So much that I decided to gather some evidence and see where it points. I set up a simultaneous packet capture on both the VPN-connected Windows client and the ASA to which that client is connected. Here is a diagram of the test setup:...
7
I think BGP is probably your best bet in this situation. The number of tail sites you have quickly exceeds the benefits of most IGPs. BGP would allow you to achieve all of your desired implementation requirements, such as limiting tail site knowledge to the primary/backup DC, standards based protocol, ability to efficiently handle over 5,000 different ...
7
Why can't we just put a VPN on a normal cable connection?
You can. I VPN to the office from my phone reasonably frequently.
What technology you use for the transport layer is ultimately irrelevant: as long as you are on an IP network and your routers support VPN pass-through, you can use whatever you like. Dial-up, DSL, cable, ethernet, smoke signals...
...
7
The VPN allows you to connect to your employer's private network and acquire an IP address of that private network. Once you're connected to the VPN, it's like you are using one of the computers inside the company -- even if you are physically located on the other side of the world.
Most probably, your employer requires you to connect via VPN first because ...
7
Take for example the GRE-Header (GRE is a protocol used to realize VPNs - its not often used as its not secure in any way, but the concept with encapsulation is nearly the same in every VPN connection (so also with IPsec for instance)):
As you can see, the original packet gets encapsulated into another IP-Packet.
Lets assume there are two networks/routers (...
7
A protocol is a set of rules for how to accomplish something, and network protocols are sets of rules for how to communicate on a network.
VPN is a concept, and a VPN uses protocols to accomplish the concept, but VPN itself is not a protocol. For example, a VPN could could use SSH (a protocol), that uses TCP (a protocol), that uses IPv4 (a protocol), etc. ...
6
The ACL associated with a point to point VPN should always contain both source and destination information. To classify "interesting traffic", that is the traffic to be protected and then sent to a remote endpoint, Cisco devices (routers and L3 swithces and ASAs oh my) will look at both source and destination addresses. If you would like a singular host to ...
6
Access lists aren't a problem here.
The output from show cypro isakmp sa tells you that the key negotiation is failing (MM_NO_STATE).
The log entry says that the hub wants to use a transform set (esp-aes, esp-sha-hmac) that you don't support. None of the transform sets on your router include esp-aes, esp-sha-hmac.
I suggest you add that to your list of ...
6
Can I change that simply by typing the following in conf t:
In your example, issuing crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3 will append 0.9.8.7 6.5.4.3 to your existing peer list for Outside_map's sequence number 10. The peer list can hold up to ten addresses.
ASA3(config)# show run crypto | i peer
crypto map Outside_map 10 set peer 1.2.3.4 5.6....
6
I think your question is not truly correct.
First of all, as explain here
"an MPLS VPN is a VPN that is built on top of an MPLS network, usually from a service provider, to deliver connectivity between enterprise office locations. "
The MPLS is the mechanism that directs data from one network node to the next, based on short path labels instead network ...
6
Most of your answers can be found here:
http://linux.die.net/man/5/ipsec.conf
To speak through them however:
left will specify the IP address of the left peer, as it is seen from the right peer. Typically, this public IP address of the left peer.
leftsubnet will specify the IP subnet for the left subnet. In the end, the IPsec SA (secure data channel) will ...
6
The link you provided was broken, so I couldn't validate the context.
But, as I contributed to the other thread, I might be in a good place to help contribute to this =).
At the end of ISAKMP (Phase 1), three keys exist:
Derivative Key -- this key is not used by ISAKMP, and is instead handed to IPsec so that IPsec can create its own Secret Keys
...
Only top voted, non community-wiki answers of a minimum length are eligible