IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.

learn more… | top users | synonyms

3
votes
1answer
2k views

What is the difference between “Main” mode and “Quick” mode when using IPsec in Windows Server?

What is the difference between “Main” mode and “Quick” mode when using IPsec in Windows Server? When does each one come into play?
0
votes
1answer
807 views

StrongSwan + xl2tpd client timeout between 2-5 minutes

I run CentOS 6.4 on Amazon EC2, using xl2tpd-1.3.1 from EPEL repository together with StrongSwan 5.0.4. I setup a simple IPSec connection: conn l2tp type=transport keyexchange=ikev1 ...
2
votes
1answer
953 views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...
1
vote
1answer
100 views

Inspect IPSec payload prior to encryption

I have a Windows 7 IPSec VPN setup. When inspecting the IPSec packets generated by Windows in Wireshark the corresponding payloads are, as expected, encrypted. Is there a way to inspect the ...
2
votes
0answers
181 views

Having trouble installing Racoon and Strongswan on the same system

I have two applications that I need to run, one uses Racoon for establishing IPSec tunnels and the other uses Strongswan. Therefore, I need both Racoon and Strongswan installed simultaneously on my ...
0
votes
1answer
136 views

VPN ipsec tunnel from router to single windows server computer (gateway-to-host)

Firstly, is this possible? I haven't seen any posts that talk about this. The situation: 2 different ISP's. One has several servers and a firewall running. The other is limited to only one virtual ...
3
votes
0answers
233 views

Restrict access to RD Gateway based on IP

I'm trying to restrict who can access our RD Gateway based on both their group membership and IP address (so people in group A can only access the system from IP address X). The Network Policy Server ...
0
votes
0answers
29 views

Side2Side VPN avoid subnet configuration

I have a side2side VPN created with strongSwan. It is working so far. But I have a basic problem regarding the configuration effort. The VPN Gateway (cloud) should handle a lot of connections from ...
1
vote
1answer
3k views

How do I configure routing for an IPSEC tunnel between Openswan and RouterOS

I am trying to create a site-to-site VPN between a Linux router that runs openswan and shorewall (host A, serving subnet 10.10.0.0/16) and a MikroTek RouterBoard running RouterOS 6.3 (host B, serving ...
-1
votes
1answer
45 views

Openswan stopped writing to /var/log/secure after log deletion

I deleted the log intentionally but it seems like Openswan is not creating a new one on it's own. I tried restarting the service or even creating an empty file. Nothing works. What can I do besides ...
3
votes
1answer
637 views

Simultaneous IKEv1 and IKEv2 connection support in Strongswan

I'm using Strongswan to handle IPsec connections, and need a way to support both Windows (IKEv2) and OS X (IKEv1) clients. I would prefer to use pure IPsec (i.e. avoid having to setup L2TP) unless ...
0
votes
0answers
116 views

Automatic IPSec IP Blacklist

A new client of ours has a legacy web app on Win Server 2008 R2 and when we started diagnosing the event logs, there were multiple ip's in China trying to hit both their sa sql account and trying to ...
0
votes
1answer
758 views

xauth with ipsec-tools on openwrt: authentication failing?

I'am trying to set up xauth with ipsec-tools on openwrt, my settings show below: cat /etc/racoon.conf: path include "/etc/racoon"; path pre_shared_key "/etc/racoon/psk.txt"; path certificate ...
2
votes
2answers
5k views

strongSwan IKEv2 + Windows 7 Agile VPN: What is causing Error 13801

I have an AWS instance that I want to be a VPN server. It will connect Windows 7 clients to a private network in the Amazon cloud. I have installed Ubuntu 12.04 and the strongswan-ikev2 package. ...
1
vote
0answers
189 views

IPsec connection established but xl2tpd times out

This may or may not be related to my problem with passing ipsec verify. I have configured L2TP/IPsec VPN on Ubuntu 13.04 following Ubuntu's community documentation and while IPsec connection seems ...
1
vote
0answers
30 views

Multiple IPsec tunnels implented with raccon - need tunnel specific debug output

I have a network appliance box serving as an end point for several site to site IPsec VPN tunnels. raccon's docs specify that a log file can be written to with the -l option. My clunky approach to ...
0
votes
1answer
724 views

How to NAT behind public IP on pFsense before IPSEC to Cisco ASA?

I have two networks: Local 192.168.1.0/24 and Remote 10.8.8.8/24. On the local network I have installed pFsense as gateway. On the remote network there is a Cisco ASA that I don't have control over. ...
1
vote
0answers
559 views

How Windows establishes L2TP/IPSEC VPN connection without “IPSec ID” (group id)?

I have a third-party VPN server configured with only 4 credentials given to me: server ip, preshared key, user name and user password. Under Windows 7, i can easily connect to this VPN via standard ...
1
vote
2answers
324 views

Windows 8 and SSL's EKU serverAuth flag?

I'm reading this tutorial which says, Your gateway certificate must have: An Extended Key Usage flag explicitly allowing the certificate to be used for authentication purposes. The serverAuth EKU ...
0
votes
1answer
819 views

strongswan: entirely virtual subnet [closed]

I recently set up a strongswan IPSec VPN to access some non-public services of my home server from my android smartphone. I am using OpenVPN on some other devices for the same task, but chose ...
0
votes
1answer
365 views

Secure VPN on standalone Windows 2008 R2 server

I have been tasked with setting up a Windows 2008 R2 server, and I need to allow VPN access to it. I have RRAS set up which allows clients to connect via Windows VPN. Unfortunately, is uses PPTP by ...
1
vote
1answer
3k views

Openswan + xl2tpd connections time out after a while

I have a non-NATed Openswan+xl2tpd server (Ubuntu 12.04), to which I connect with a Windows 8 behind NAT. The client loses its connection after a while of doing nothing (between 30 and 60 minutes, but ...
0
votes
0answers
368 views

CentOS 6 VPN or Proxy Server compatible with OpenVZ

So I tried to install an L2TP/IPSEC VPN on CentOS 6 using ipsec-tools and racoon. Unfortunately my VPS host uses OpenVZ which is apparently incompatible with IPSEC. (Of course if someone knows how to ...
0
votes
1answer
368 views

CheckPoint/Amazon VPC VPN tunnel working inconsistently

First time poster, so please be gentle and correct me if there's Server Fault etiquette I'm missing. We have two CheckPoint edge devices at sites A & B, independently managed, connecting to two ...
1
vote
0answers
242 views

Issue Routing along IPSEC VPN

I am struggling to get two different subnets routing along a IPSec tunnel. The tunnel is between a Vyatta (6.5) and a Juniper firewall. The tunnel was initially created to route between a subnet in ...
1
vote
0answers
339 views

racoon pure IPSEC VPN, best way to give vpn server an IP address on the VPN?

We are testing a VPN server for DR. We have a rackspace cloud instance, with a pure IPSEC VPN server running in racoon, serving "road warrior" clients. We have some NAT going on on the server to route ...
1
vote
0answers
59 views

Windows 2k3 IPsec policy. Block all traffic prevents IPSec communication

I'm looking to harden down A Win2k3 server that talks to a branch over an IPsec tunnel based connection. Windows 2k3 firewall doesn't offer control of outbound communications, so I've turned to the ...
1
vote
1answer
1k views

strongswan can't push DNS resolver to OSX Mountain Lion (split tunnel)

I'd like to set up an IPSec responder (VPN server) for OSX desktops and laptops. Everything seems to work fine, except I cannot push a DNS server to be used system-wide on the initiator (VPN client). ...
0
votes
2answers
66 views

IPSec: Reason for differentiating between Security Associations and Security policies

In IPSec, why does it make sense to differentiate between Security Associations and Security policies?
2
votes
1answer
3k views

Configure ipsec vpn tunnel (network to network with IKE with preshared key) on Centos 6 with openswan

I have Cisco Linksys router configured as VPN gateway (network to network) : Now I wanna configure ipsec VPN similarly on Centos 6 with openswan. I was looking in internet but have no luck (there ...
0
votes
1answer
5k views

Routing traffic through IPSec with NAT and IP Alias in pfSense

I have a pfSense firewall and I need to connect to a remote site (form my client). I'm running into several issues, and don't see traffic flowing in any way. Here's my setup: LAN is 192.168.0.0/16 ...
1
vote
0answers
1k views

ASA Slow IPSec Performance with Inconsistent Window Size

I have a IPSec link between two sites over ASA 5520s running 8.4(3) and I am getting extremely poor performance when traffic passes over the IPSec VPN. CPU on the devices is ~13%, Memory at 408 MB, ...
3
votes
1answer
117 views

IPSEC AES key length in kernel 3.9.3

I have a working ipsec-tools configuration which uses aes-ctr encryption with 224-bit key (192bit for key+32bit for nonce). Everything works well on 3.2.0 kernel. Here's what man setkey says about ...
1
vote
1answer
153 views

What is the cause of duplicate SA's and SPD's in IPSec L2L VPN?

Although I've been using pfSense now for some time and like it very much, I haven't been able to shake duplicate SA's. I've checked all the obvious stuff - making sure configurations match on both ...
2
votes
2answers
423 views

Cisco 871: IPsec Remote VPN

After having followed several tutorials and none of them worked for me, someone might help me here. I have a Cisco 871 router, version 12.4(4)T7. Currently, I have it configured as a PPTP VPN ...
5
votes
3answers
2k views

How do I route a public IP range over an IPSEC VPN?

So, I have an established IPSec Site to Site tunnel. Site A has a SonicWall, Site B has a EdgeRouter. The first tunnel consists of Site A's NATed ips to Site B's NATed ips. Everything works as ...
0
votes
1answer
240 views

ipsec (openswan) routing or dns issue with iphone

I got an established VPN connection, but either the routing or the resolving is not working. The configuration is taken from ...
0
votes
1answer
143 views

ipsec routing / strange routing behavior

I have following network configuration: Office1 <-- openvpn --> office2 <-- ipsec tunnel --> branch office Office1 and office2 are on Debian, Branch office: juniper srx100 Office1 ...
1
vote
2answers
145 views

Interaction of IPSec and WinPE in MDT 2010 sequence

I'm in the process of enabling IPSec and Windows Advanced Firewall within my organization. We are also using MDT 2010 for OS deployment. This is the first time I've tried a new sysprep and capture ...
2
votes
1answer
106 views

Does Juniper ScreenOS support IPCOMP?

Given an oldish Juniper Netscreen device running ScreenOS 6.2 (Juniper NS5GT-ADSL), would it support IPCOMP payload compression (RFC 2393) in IPSEC tunnels? If so, any reference on how to set it up?
1
vote
1answer
370 views

Routing Asterisk traffic evading a VPN

I have two offices set in two distant locations, connected through a IPSec VPN (using pfSense). On one office, I have an Asterisk PBX where all the extensions connect, and the Asterisk PBX is ...
0
votes
2answers
973 views

what does “openssl FIPS mode(0) unavailable” mean?

I compiled and installed strongswan ipsec vpn successfully, as demonstrated by the fact that the service starts successfully: as3:~# ipsec restart Stopping strongSwan IPsec... Starting ...
1
vote
1answer
3k views

How can I NAT traffic for one VPN to come from a different IP on Cisco ASA?

I have a Cisco ASA firewall between our private network (10.1.0.0/16) and the outside world, and multiple VPNS going to client sites. Existing: [10.1.0.2...] = source client | [10.1.0.1 ASA ...
0
votes
2answers
565 views

Can IPv6 IPSec replace https/ssl for secure website network encryption?

Take away the 'authentication' part and just talk about the encryption part please! (Authentication is a different problem.) Example: a connection to http://ipv6.google.com can be encrypted via HTTPS ...
0
votes
0answers
615 views

Cisco ASA IPSec Mobile VPN Drops After Inactivity

When I connect to my Cisco ASA 5510 via the built in IPSec VPN on my ipad (over both 3G and Wifi) the connection drops without error (the icon just disappears once I go into settings to check on time ...
3
votes
0answers
172 views

Cisco ASA ipsec vs Anyconnect client issue

So I have an iPad that has a IPSec VPN created. I am able to connect from the outside fine and I can access my local LAN files just fine. When I connect with the Cisco AnyConnect client from the same ...
2
votes
0answers
900 views

Site-to-site VPN between Azure Virtual Network and a Cisco RV016

I'm attempting to configure a Cisco RV016 router to connect to an Azure Virtual Network to create a site-to-site VPN, but it's not working. I'm aware that a Cisco RV016 is not in the list of ...
0
votes
1answer
131 views

Cisco IPSec VPN: Multiple address ranges for crypto map?

I'm setting up an IPSec VPN using a Cisco router. The relevant part of the config: crypto map MYVPN 10 ipsec-isakmp set peer 173.1.2.3 set transform-set my-transform set pfs group2 match ...
3
votes
0answers
363 views

IPSec + L2TP + NAT-Traversal does not work for multiple clients behind same nat

I have recently configured a VPN server hosted in AWS EC2. Details: Centos 6.4, openswan, xl2tpd, NAT-traversal. The configuration works great for a scenario when only one user connects form a given ...
2
votes
2answers
5k views

Openswan tunnel up, but works only in one direction

I've successfully established an IPsec connection, but it works only partially. One side does not send out packets through the tunnel. It seems as if the network topology is unclear to this side. ...