IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.

learn more… | top users | synonyms

1
vote
0answers
13 views

Is there an extension of host to host ipsec to a many-many configuration?

Having a typical host to host transport mode ipsec configuration, conn appserver01-to-swift01 leftid=@appserver01.server.com left=10.133.176.246 leftrsasigkey=xxxxxxxxxxxxxxxxxxxxxxxx ...
0
votes
0answers
25 views

Strongswan IPsec: routing arbitrary subnets over /32 IPsec endpoints

I have a basic setup between two sites A (FreeBSD, 10.0.0.1/24 nat'd to 1.1.1.1), B (Linux, 2.2.2.2), with only A behind NAT. I've only been able to get it working in tunnel mode. Here's my ...
0
votes
1answer
33 views

IPsec VPN between Fortigate 60C and openswan up, but no traffic

I get visual confirmation that the tunnel is working from the fortigate GUI but, it also says i don't have 1 byte of traffic, the linux server also confirms the tunnel is open but i can't ping ...
0
votes
1answer
48 views

Docker & StrongSwan: Destination Host Unreachable

I'm having a bit of trouble communicating between containers using my IPsec tunnels. Here's my setup: I have Docker installed on multiple Ubuntu 14.04 hosts and I'm running various containers on ...
0
votes
1answer
121 views

How to setup L2TP IPsec VPN server on Windows Server 2008 R2?

The Windows 2008 R2 (SBS) machine was earlier setup to run a PPTP VPN server. Due to security concerns I do want to replace the PPTP by L2TP/IPsec VPN server. The server is behind a NAT router where ...
3
votes
1answer
44 views

VPN ERROR 500 STATE_MAIN_I1, unable to start phase2

i'm trying to set up a site to site vpn to a fortigate 60c from a CentOS 7 with openswan, the error i get everytime is the following 000 #1: "office":500 STATE_MAIN_I1 (sent MI1, expecting MR1); ...
0
votes
1answer
25 views

How can I tell strongswan that left is local (independent of IPs)?

Is there something like local = left which I could use in the strongSwan configuration? I don’t want to use any IP-addresses, as they might change. And I don’t want the server to guess it, I want to ...
0
votes
1answer
16 views

Start ipsec tunnel from another machine

I have to monitor the IPsec tunnel on machine A which is behind a firewall F, where the OpenSwan sits on. From machine A, if the tunnel goes down, I would restart the tunnel on machine F. What I did ...
1
vote
0answers
14 views

Microsoft Message Analyzer and Windows Advanced Firewall ipsec tunnel packet sniffing

I am trying to view connections or attempted connections in windows advanced firewall. I have tried using the Windows Firewall Service provider however the trace does not return anything. Any ideas?
1
vote
1answer
27 views

When and with which parameters does strongSwan select a connection?

StrongSwan (as responder) selects a configured connection (conn section in ipsec.conf) for each incoming initiator key exchange intent. At which times does strongSwan pick a connection configuration? ...
3
votes
1answer
132 views

Windows Server FIrewall (2012) Ipsec tunnel problems

I am new to Ipsec tunnels. I have successfully created a tunnel to a Cisco offsite router using a preshare key at a supplier. In Endpoints 1 : I have the servers ip address and the remote servers ip ...
2
votes
1answer
101 views

OS X 10.10 to StrongSwan VPN

I'm trying to to test a new (in progress) StrongSwan IPSec VPN server by connecting from OS X 10.10. This is very frustrating because the the logs show a series of "success" messages, but then the ...
0
votes
0answers
28 views

IPSec tunnel through ASA from specific IPs

I'm having some difficulty getting an IPSec tunnel to work through an ASA5510 that is already configured with a number of different tunnels that it terminates, as well as individual VPN clients. ...
0
votes
0answers
17 views

Enable IPSec on Firewall

I am using ProfitBrick for my Cloud infra. However, if I enable their firewall, IPsec does not pass through. The ports opened on firewall are: TCP 53 TCP 51 TCP 4500 TCP 500 UDP 4500 UDP 500 Does ...
0
votes
0answers
90 views

Missing /etc/init.d/ipsec script after installing strongswan 5.3.2 from source

Ubuntu 14.04 (Amazon's Ubuntu AMI). Installed strongswan 5.3.2 from source (latest version in repo is too old and doesn't work). 1 question: 1) Noticed that the /init.d/ipsec (or /init/) script is ...
1
vote
3answers
25 views

Cloud based security gateway

An organisation whose IT I'm involved with has offices in a country which blocks access to various well know services such as Skype. I can get around the issue by routing all the traffic over IPSec ...
0
votes
0answers
17 views

ipsec.conf leftsubnet different than actual subnet

I've been tasked with troubleshooting an ipsec.conf and I'm having difficulty understanding a specific portion of the configuration. Specifically, I cannot figure out why this config is using a ...
1
vote
0answers
23 views

IPsec Security Associations prevail even after IPsec tunnel is down

I am working on a script that can detect if existing IPsec tunnels on a system have gone down. From my observations, I have seen that it can take any where between 1 second to 8 minutes for this to be ...
2
votes
1answer
127 views

Poor IPsec over GRE performances

I have set up an IPsec over GRE connection with a remote host, both are NetBSD 6.1 based. The "client" is connected to the Internet through a 400Mbps fiber connection. The "server" is located on a ...
0
votes
0answers
80 views

Juniper SRX IPSec tunnel to Microsoft Azure Dropping

I'm a bit stumped and was hoping to find some guidance here. I've configured an IPSec tunnel to Microsoft Azure from my Juniper SRX240 (12.1X44-D45.2). The tunnel works fine but phase 2 drops when ...
0
votes
1answer
69 views

Configure StrongSwan to work with DHCP

I have implemented a StrongSwan VPN server and would like to configure it to dynamically assign IPs to the end client. The VPN works if I give it an IP range however not if I set it to DHCP. This is ...
0
votes
0answers
140 views

ipsec vpn up, but no traffic, no ping

I've set up a VPN between my mikrotik router and Google Cloud Platform VPN. According to the Green check next to peer IP on the VPN Console, VPN is up, but all pings are timed out. > /ip ipsec ...
0
votes
0answers
133 views

Creating IPsec tunnel Ubuntu 15.04 ip sec tools

I'm trying to setup a VPN/Tunnel between three(3) Ubuntu 15.04 servers. I've googled and it seems that I can use IPsec tools for this. I've only found the following ...
0
votes
0answers
39 views

IOS FlexVPN client keeping create child SA every 60s?

I got a flexvpn client with sVTI tunnel interface, but it keeps creating child sa every 60s, like below. The VPN server is a linux Strongswan box, the config works fine in IOS 15.3 but not 15.4+. Any ...
1
vote
1answer
87 views

Routing between pfSense Subnets and IPSec VPN

I have a pfSense Router, which is the endpoint of a site-to-site IPSec VPN. In the pfSense the main LAN Interface is 10.0.2.1/24 and it has a virtual IP 10.0.125.1/24 The IPSec Phase 2 connects the ...
-1
votes
1answer
18 views

firewalld: match which zone by policy

I have the following zones that are relevant for this question. SemiTrusted and Public I want to treat IPSEC-encrypted traffic (that is coming from some specific IP addresses) as belonging to ...
0
votes
1answer
34 views

TCP syn, ack Lost Before Entering IPsec VPN tunnel

I have configured a site to site VPN which is working fine as traffic is going through the tunnel. I am able to ping and Telnet hosts on the other network and they are able to ping me back. The ...
0
votes
0answers
129 views

L2TP + IPSec pfSense: can ping, no access

I am in process of setting up a L2TP + IPSec VPN (site to client) server based on pfSense. While being connected to the VPN, I am able to ping any of the resources (e.g google.com, as well as anybody ...
0
votes
0answers
133 views

IPSec Tunnel AWS VPC <-> openSwan CentOS 6.6 Tunnel up, no traffic

I managed to get a tunnel up between a CentOS 6.6 box and our AWS VPC. It shows as connected on the box, and in AWS, but the problem is routing the traffic from the server. Everything I've tried ...
0
votes
0answers
32 views

OpenSwan IPSec tunnel not routing correctly

I am trying to enable site-to-site connectivity between my network and a Windows Azure network. I have configured openswan in the local network and service ipsec status reports that the tunnel is up ...
0
votes
0answers
45 views

IPSec offload in Windows Server 2012 R2 with teaming

I'm interested in exploiting IPSec offloading in Windows. It is for implementing a custom PPP over L2TP/IPSec solution. Microsoft Windows VPN features are not suitable for the task, because I'm ...
0
votes
1answer
97 views

CentOS 7 ipsec hardware rngd erorr

ipsec verify Hardware RNG detected, testing if used properly [FAILED] Hardware RNG is present but 'rngd' is not running. No harware random used! Someone suggest to edit ...
0
votes
2answers
169 views

Strongswan VPN tunnel between two AWS instances won't connect

I am trying to set up a VPN tunnel using StrongSwan 5.1.2 between two Amazon AWS EC2 instances running Ubuntu 14.04.2 LTS. Prior to using StrongSwan, I used open(libre)swan on an Amazon RedHat AMI, ...
0
votes
1answer
65 views

Setting up site-to-site IPsec in bridged mode

I'd like to set up site-to-site IPsec in bridged mode: that is, where the hosts in each site don't need to be modified to use the IPsec gateway, but the IPsec gateway acts as a pseudowire. My plan to ...
0
votes
0answers
16 views

How does IPSec right=%any setup the SA?

I've seen lots of examples where each gateway in an IPSec is configured with right=%any. I'm perplexed how these gateways find the IP to connect to (assuming both gateways are set up that way). The ...
0
votes
2answers
130 views

Accounting IPSec connections with RSA authentication

Apple iOS has "VPN On Demand" function. With this function the VPN connection is made whenever the device tries to connect to certain domains or to the internet at all. iOS supports "VPN On Demand" ...
1
vote
2answers
189 views

IPSec on OpenVZ multiple ip addresses, using 127.0.0.2 on venet0

I have an OpenVZ box with IPSec enabled. root@wa000:~# ipsec verify Checking your system to see if IPsec got installed and started correctly: Version check and ipsec on-path ...
0
votes
0answers
91 views

strongswan/centos7: Don't get answer from other side (but IPSEC connection seems OK…)

My question: I can't access the other side server to get service, no ping, no telnet working. Is there something wrong on my side? I have problem with Strongswan on centos 7 (compiled version 5.3.2). ...
1
vote
0answers
56 views

openswan IPSEC site to site randomly disconnects on debian server

goodmorning my friends, this is my situation: I have two debian servers with static IP connected through a site to site VPN OPENSWAN, everything works like a charm, I can ping the entire lan from any ...
0
votes
1answer
60 views

OpenSwan Dead Peer Detection for Mac WIFI clients

I am running an OpenSwan server to facilitate client-server connections into a secure data centre. I have a problem with the standard L2TP over IPSEC client in MacOS, specifically when using WIFI. ...
0
votes
0answers
122 views

L2TP\IPSec PSK server in Windows Server 2012 R2 not working

Im trying to get Windows Server 2012 R2 to work as a L2TP\IPSec PSK server and I feel that Im doing everything correctly but it seems that either it does not authenticate or there is something wrong ...
0
votes
0answers
104 views

Android client to Windows Server 2012 R2 VPN IPSec: Firewall says “No proposal chosen”

Im trying to connect my Android device (5.0.2) to my Windows Server 2012 R2 IPSec VPN but the firewall pops up a error saying "No Proposal Chosen". Ive looked around and it seems the encryption is ...
1
vote
2answers
415 views

IPSec VPN set up (Windows)

I am working on a project which needs to call a web service that can only be accessed whilst being connected via a VPN. The legacy platform that we're migrating from ran on OpenBSD and used the ...
0
votes
0answers
68 views

asa5512x: ipsec site-to-site vpn with tcp instead of udp? is it possible?

the cisco documentation for ASA 9.1 (I have 9.1.2) seems to imply that ipsec vpn with tcp/ip is only for remote clients, not site to site vpn. But I repeatedly see people mention vpn over tcp to ...
0
votes
0answers
179 views

VPN to Server 2012R2 with IKE behind NAT

I am having trouble to set up a VPN Tunnel from a Sonicwall TZ 100 to Windows Server 2012R2. I follow the guide from there Configuring a Site-to-Site VPN tunnel in SonicOS Enhanced firmware using ...
1
vote
0answers
67 views

Windows Firewall Connection Security with Certificate (2)

I have a similar problem as the question with the same title from last October. On a Windows Server 2008 machine, using Windows Firewall's Connection Security rules, I need to establish an IPsec ...
0
votes
1answer
73 views

Creating a separate PPTP VPN VLan in network with tagging possible?

I have a gateway to gateway PPTP VPN that I would like to connect to my network and have it on a VLAN where it is shared to a VLAN tagged wireless router. This way I can have two wireless AP's where ...
0
votes
2answers
148 views

iked mutex lock issue

On Ubuntu 15.04, fresh install of the ike package with these requirements installed: cmake libqt4-core libqt4-dev libqt4-gui libedit-dev libssl-dev checkinstall flex bison results in: $ sudo iked ...
0
votes
0answers
131 views

Ubuntu 14.04 Cant connect to openswan/xl2tpd/IPsec VPN via iOS

I am setting up a VPN using openswan, xl2tpd, and IPsec and i am getting issues with connecting via an iOS device with the error "You were disconnected by the communication device". This is configured ...
0
votes
1answer
247 views

Route all traffic through StrongSwan VPN

I'm new to this - please excuse my ignorance. I have looked through many other similar questions to no avail. Trying to set up a StrongSwan VPN such that client C can connect to host H, be assigned ...