Questions tagged [ipsec]
IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.
1,035
questions
5
votes
1
answer
12k
views
Site-to-Site IPsec vpn not sending ping across a tunnel
This is my first attempt at a site-to-site VPN. I chose to use IPec because it appeared to be the best solution for what I needed to accomplish. I've followed several different tutorials over the last ...
1
vote
0
answers
97
views
IPSEC on linux with multiple remote ISP
I have configured 2 ipsec VPN connection from my linux server to my clients locations. the reason being the client has two ISPs a primary and a secondary on. The client wants to switch to secondary ...
1
vote
0
answers
3k
views
Cannot connect to IPSEC/L2TP VPN Arch Linux/Windows 8
I have check a lot of other L2TP/IPsec VPN post and none of them seem to quite match the issues I am having so here is what going on.
I am trying to set up a VPN on my Arch Linux server that I can ...
3
votes
2
answers
6k
views
Trying to replicate a working IPSec/L2TP config from OpenSWAN to StrongSWAN
I have a working OpenSWAN implementation for RA, using IPsec transport and l2tp for the tunnel, running in AWS. The instance has a private IP, with a public EIP mapped to it.
I use the private ip for ...
-1
votes
1
answer
1k
views
Openswan and OpenVPN
I have installed Openswan and have configured IPSec tunnels and they work perfect until i install OpenVPN. Now i can't find out way the ping wont work.
When i execute the "service ipsec status" it ...
5
votes
2
answers
5k
views
TCP connection through IPSec (Linux/Strongswan) stalls after exceeding PMTU
The backups (via Bacula) of one of my servers (“A”) connected via IPSec (Strongswan on Debian testing) to a storage daemon (“B”) don't finish 95% of the times they run.
What apparently happens, is:
...
4
votes
1
answer
3k
views
Windows 7/8 Strongswan IKEv2 Wrong Gateway
I have setup Strongswan on Ubuntu 14.04 from the official package. I use IKEv2 with PKI authentication and a custom authorization plugin. This works great for Android and Ubuntu clients using ...
2
votes
1
answer
1k
views
Is there a way to use an external program to authenticate XAuth with StrongSwan IPSec?
I'm currently using StrongSwan for my iOS devices to connect. I was wondering if there is a way to use an external program for XAUTH? I currently have the following configuration:
: RSA server.pem
...
0
votes
0
answers
706
views
Cisco ASA 5505: PAT / NAT between 2 IPSec Tunnels
I've the following Setup:
Customer <-> HQ <-> Branchoffice
The Customer has a 192.168.1.0/24 subnet.
On the HQ only the VPN Gateway is in my context, 172.20.10.1 .
And on the Branchoffice side ...
3
votes
0
answers
7k
views
Allowing LDAP authentication from DMZ to Active Directory. Is my idea secure?
I have a internet-facing application server that I want to use AD authentication. This is my first time doing this for a none MS application or without some sort of proxy. I already have a idea in my ...
0
votes
1
answer
8k
views
How can I configure IPSec on Windows 2012 R2 to use Pre Shared Key compatible with Android phones?
Our company has to comply with the mandate that all mobile phones use L2TP or IPSec VPNs when using untrusted Wifi or GPRS connections... namely to protect from MITM attacks. Were also interested in ...
0
votes
0
answers
312
views
vServer: Configuring single (/128) assigned IPv6 addresses for use as IP address pool for IPSEC (Strongswan) road warriors
I've a new (dev) vServer up and running. Unfortunately the provider only hands out single IPv6 addresses (not even /64 subnets). Now I am a bit confused how to achieve the following: I want to use ...
1
vote
0
answers
791
views
Route between two branch offices via IPsec VPN to head office?
I have TMG 2010 running on Server 2008 R2 in our head office with 2 branch offices connecting in using Dray Tek 2930 routers with IPsec site to site VPNS. The remote sites can route between the head ...
1
vote
4
answers
19k
views
Allow traffic from ssl-vpn to enter ipsec tunnel on fortigate
we configured our FortiGate 50B to route traffic from our local net 192.168.10.* (which is our office) to a remote network 172.29.112.* using an ipsec tunnel. Everything works fine as long my computer ...
0
votes
0
answers
587
views
Windows 2008 R2 site-to-site IPSEC tunnel with Juniper: tunnel up but packets are lost
I am stuck on this task almost for 2 days. Organized a site-to-site IPSEC tunnel between Juniper and Windows2008R2 machine (let's call it W2008R2 for reference). W2008R2 is a multihomed machine (2 ...
5
votes
2
answers
8k
views
SSH not working over IPSec tunnel (Strongswan)
I configured a small network on a cloud virtual machine.
This virtual machine has a static IP address assigned to eth0 interface that I'll call $EXTIP. mydomain.com points to $EXTIP.
Inside, I have ...
4
votes
1
answer
5k
views
Windows 2008 R2 IPsec encryption in tunnel mode, hosts in same subnet
In Windows there appear to be two ways to set up IPsec:
The IP Security Policy Management MMC snap-in (part of secpol.msc, introduced in Windows 2000).
The Windows Firewall with Advanced Security MMC ...
1
vote
1
answer
4k
views
Vpn tunnel to Amazon VPC with pfsense
I'm trying to create an ipsec tunnel between my office and our Amazon VPC. However I have never used ipsec before so I'm at lost.
The gateway/firewall is running pfsense 2.1.3-RELEASE (i386) on ...
2
votes
1
answer
3k
views
FreeRADIUS w/ MySQL backend. IP Pool
I have a pool of addresses (172.16.0.0/24) configured on my NAS (Cisco 2921 router) for my IPsec clients.
I have various subnet mask length subnetworks used for different user groups. For example I ...
9
votes
2
answers
24k
views
Strongswan (IKEv2) connection established, but no traffic routing
I've seen this sort of question posted a few times before, but so far, none of them have solved my issue.
I'm trying to set up an IKEv2 VPN on my Ubuntu Server to use with my Windows Phone using ...
1
vote
1
answer
2k
views
How to exclude LAN traffic from IPSEC policy
I am trying to replace a Firewall/VPN appliance (Snapgear SG300) with another (Mikrotik RB951G-2HnD). My current router works, but, for the new mikrotik router, when I add the phase 2 tunnel, I can ...
2
votes
0
answers
2k
views
Is it possible to do IPSec Site to Site VPN without static & public IP on one end?
I am working on a project for my engineering degree that requires me to interface with some pre-existing equipment, so I am rather limited on my options. I'm rather new to VPN and ipsec for that ...
1
vote
0
answers
5k
views
IPsec Xauth RSA - Debian 7 and Android 4.4 VPN (Always-ON) and Mac OS X 10.9.2 VPN (On Demand)
I successfully installed IPSec Xauth RSA using this instruction: http://jsharkey.org/blog/2012/09/22/deploying-a-pure-ipsec-pki-vpn-server-for-android-devices/
In brief:
apt-get install ipsec-tools ...
1
vote
0
answers
123
views
is there any cisco-compatible ipsec+comp module?
I am looking for a waqy to establish an Ipsec tunnel(with lzs-compression enabled) between a cisco router and a host(using strongswan or sth else).
I can establish a tunnel without lzs-compression. ...
5
votes
2
answers
4k
views
Elastic IP address on EC2 instance interface without 1:1 NAT
I have a basic Amazon VPC set up with a public and private subnet. I have deployed a Vyatta router in the public subnet that does NAT for the private subnet. I have an elastic IP address assigned to ...
3
votes
1
answer
6k
views
Openswan Cisco ASA 9.1 -- cannot resopnd to IPsec SA request because no connection is known for
Ok, so I have a simple VPN IPSEC setup with a single Linux host that has a public IP address and a loopback interface of 172.16.255.1. On the right side I have a Cisco ASA 5505 9.1. the issue is the ...
0
votes
1
answer
271
views
User can access Windows based Apache sites but not linux Apache server over site-to-site VPN
I have a user (Win 7 Pro 64-bit) in a satellite office (10.1.0.0/24) that is trying to access web services in our main office (10.0.0.0/16) over a site-to-site VPN between a a Meraki MX60W and a ...
0
votes
1
answer
3k
views
Openswan is not sending packets on new ip after DPD
I have configured tunnel with DDNS. After appliance get rebooted the other side is not sending packets on new ip-address (even i have set dpdaction=restart).
I am using openswan 2.6.38.
Here is my ...
1
vote
1
answer
3k
views
Strongswan with X.509 authentication and LDAP authorization
I would like to setup Strongswan/Libreswan with PKI authentication. Now I have searched and found only how to configure specific accepted client certificates like here: http://technikenity.blogspot....
1
vote
1
answer
437
views
VPN Tunnel set up Issues - Cisco WRVS 4400N to Server 2008 R2behind ASA5505
I was wondering if someone could help with a scenario i have that i am not sure how to set up regarding a VPN tunnel set up.
I have a Cisco WRVS4400N business router , and on this device , i need to ...
0
votes
1
answer
9k
views
Cannot connect to VPN on Server 2012
We run a small business and have a server that runs our VPN on Windows Server 2012.
Our VPN was working fine until we restarted our router and it seems that restart procedure broke the VPN. We are ...
3
votes
1
answer
1k
views
Is using EAP-MD5 in strongSwan a security risk?
Quoting Wikipedia:
It offers minimal security; the MD5 hash function is vulnerable to dictionary attacks, and does not support key generation, which makes it unsuitable for use with dynamic WEP, or ...
1
vote
1
answer
2k
views
IPSec on Domain Controllers and Trusted Domains
I am looking at configuring IPSec as follows:
Isolation
Request authentication for inbound and outbound connections
Computer and user (Kerberos V5)
I am looking to do a blanket deployment across ...
1
vote
1
answer
691
views
Testing IPsec with Nagios / Icinga?
Several of my Windows servers are running IPsec. There are a small handful that have problems when rebooting with the IPsec services not coming up.
As a result I'd like to set up a monitoring check ...
1
vote
1
answer
1k
views
Linux IPSec between Amazon EC2 instances on same subnet
I have a requirement to secure all communications between our Linux instances on Amazon EC2 - we need to treat the EC2 network as compromised and therefore want to protect the data that's being ...
3
votes
1
answer
2k
views
L2TP VPN Connection on Debian Squeeze
I need to make an L2TP VPN connection from a Debian Squeeze server.
What I have is:
The server IP address
Shared Key
My username and password
Just using these 3 parameteres I can establish the VPN ...
0
votes
1
answer
387
views
How is my GRE-Tunneled packet being routed? [closed]
I'm trying to figure out exactly what is happening when I create a GRE tunnel.
My network looks like this (-> means directly connected):
Computer A (eth0: 10.0.1.1) ->
(eth0: 10.0.1.2) Router B (...
2
votes
1
answer
107
views
Should we accomodate a customer asking us to NAT servers behind new PUBLIC IPs within a VPN?
We're a SaaS provider, setting up a IPSec VPN between our data center and a customer's site so they can directly access their hosted database server from their LAN.
Instead of exposing our internal ...
0
votes
0
answers
468
views
Site-to-Site VPN not connecting with Cisco 877
I can't seem to get the VPN connection going with my 877. I have an old IOS (12.4) but it looks to me like all the pieces are there. I have compared this config against the Azure-provided (albeit ...
9
votes
1
answer
38k
views
strongSwan setup where both sides are behind NAT
I'm trying to setup a strongSwan server in my home and connect to it from another network. Let's say sun is the VPN server and venus is the client. Both sun and venus are behind NAT networks. sun is ...
1
vote
1
answer
3k
views
EAP password prompt in strongSwan
I'm trying to setup a host-host configuration using strongSwan. I did manage to set it up using certificates and now I wish to set it up using certificates + EAP authentication.
I mixed this ...
21
votes
2
answers
42k
views
Is it possible for L2TP VPN to do auto route configuration for client during connected?
We've setup a L2TP VPN server with this tutorial, everything works like a charm.
The only issue is
We don't want client to route all traffic using this VPN, only a particular subnet, e.g. 10.0.0.0/...
0
votes
0
answers
1k
views
Site to site IPSec VPN between Server 2012 and USG 50
I am looking to setup an IPSec VPN server in our organisation using a Windows server 2012 machine with remote access and routing installed. I would then like to perform a site to site IPSec VPN ...
0
votes
0
answers
980
views
Debugging IPSEC log
A Fortigate unit and a Openswan based Linux server.
Tunnel is up but no data goes through.
This is the log from the Forti unit:
Line 204: ike 0:Brazil_VPN:2803378:19809969: responder received first ...
1
vote
1
answer
2k
views
Issues with StrongSwan on FreeBSD 10.0. Charon refuses to start
The charon.log with full debug levels (4) is as follows:
Jan 21 16:09:47 00[DMN] Starting IKE charon daemon (strongSwan 5.0.4, FreeBSD 10.0-RELEASE, amd64)
Jan 21 16:09:47 00[LIB] plugin 'aes': ...
0
votes
1
answer
147
views
Is secure pptp not possible on Ubuntu?
From [1], it was said that
1) All users and providers of PPTP VPN solutions should immediately start migrating to a different VPN protocol. PPTP traffic should be considered unencrypted.
...
0
votes
0
answers
2k
views
Fortigate VPN can't reach site
I've two Fortigate's here and I use one of them for each site.
Site A Site B
192.168.2.0/24 <---------- VPN -----...
1
vote
0
answers
287
views
Windows server 2003 ipsec error
I have a Windows Server 2003 domain controller and a bunch of clients. Something happened and now IPSec service fails on the server. After IPSec fails to start, all TCP/IP traffic is blocked to the ...
1
vote
1
answer
4k
views
Cisco IPSEC VPN Slow Speeds
We have a site to site IPSEC VPN, both endpoints are Cisco PIX 515e's. The links at both end are 100mb, however speeds over the VPN (logged using jperf) are at most 4mb. Obviously this represents a ...
0
votes
2
answers
399
views
Cisco IPSec Hardware Requirements
In order to use IPSec on 2811 and 2651XM Cisco routers, does one need any particular hardware module(s) or just the appropriate software?