IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.
0
votes
1answer
131 views
XCA: sign IPsec certificates with own CA
I'm trying to establish a LAN to LAN connection through a VPN tunnel. There's a Zywall at the remote office which will be responsible for establishing a connection to a Draytek at the main office. I'm ...
2
votes
1answer
306 views
What is the difference between concurrent sessions and IPsec/VPN sessions?
Our company is looking at hosting our software with an ASP model of distribution and we're looking at firewall hardware to protect our data center. My question is what is the difference between the ...
0
votes
1answer
296 views
Linux 2.6 IPSEC does not forward packets from LAN to VPN
I have site to site VPN from 10.132.2.0/24 to 10.132.1.0/24. The problem I am facing is that the packets from VPN are forwarded to LAN, as I can see them on the LAN server, but packets from LAN are ...
-3
votes
3answers
482 views
How do I learn IPSec VPN implementation on FreeBSD from pfSense
I've been trying to figure out a complete working solution for IPSec VPN implementation on FreeBSD but with no luck till now. pfSense seems did a fantastic job on supporting IPSec and even for mobile ...
1
vote
1answer
732 views
Does Linux support IPsec service out of the box?
As per subject. I have heard of default IPsec support on later versions of Linux kernel (without need to recompile or install special packages) but maybe it's a rumour?
Interested in both VPN ...
1
vote
1answer
235 views
When is an IPsec tunnel a real candidate for NAT-T (when is it absolutely required?)?
I've had a persistent problem establishing phase 1 of an IPsec tunnel I am initiating from an endpoint at my site to a vendor.
It is a bit of an odd configuration and I am not sure if NAT-T must be ...
0
votes
2answers
469 views
How to configure a CISCO ASA to support the OS X VPN Client
Given that OS X now supports (natively) CISCO IPSec VPN connections I am wondering what the requirements for the VPN configuration are on the remote end?
I have evaluated a number of CISCO devices ...
8
votes
1answer
210 views
If IPSec has its own IP tunnel support why do some add LT2P to the stack?
I understand that you can use IPSec to tunnel data securely. According to the Wikipedia page and a few other sources it can also tunnel IP packets and then route them through an interface. That would ...
0
votes
2answers
623 views
IPsec tunnel keep crashing
I have 2 locations. On each location is installed VPN device Cisco RV042. Link between location is optical fiber. ISP is the same. Link speed on location A is symetric 3/3 Mbps, and there is
static ...
1
vote
0answers
323 views
How to allow RDP through IPSEC using netsh advfirewall command
I have an offsite windows server 2008 R2 server. And an ipsec tunnel set on our router here plus a connection security rule in Advanced Firewall on the server. I have ssh access to the console on the ...
2
votes
2answers
1k views
How to force a Cisco 2811 to rekey
We are having a IPsec/GRE VPN tunnel issue at work. Our vendor told me he "forced a rekey" and everything started working again. He alluded to a command to this, but didn't tell me the exact one. Does ...
3
votes
1answer
286 views
Where is wfp.tmf for Windows Server 2008 R2
I'm trying to debug IPSec Main Mode / IKE issues using wfp tracing and/or debugging of the IKE IPSec service. I've got the ETL files and tracefmt from the DDK, but I don't have wfp.tmf for my platform ...
1
vote
1answer
393 views
What can cause a DirectAccess IPSec Main Mode Error “no policy configured”
We have Microsoft's DirectAccess VPN set up on Server 2008 R2 with end-to-edge security, and we're having trouble with the manage-out tunnel.
The DirectAccess client has DC/DNS and intranet ...
0
votes
0answers
2k views
Zywall USG 300 ipsec config issue
We have a Zywall USG 300 which dials ipsec to a Server 2008 R2 server.
This was working until recently when any attempt to communicate with the server sees the following in the logs.
error
IPSec
...
2
votes
1answer
917 views
SNAT through Racoon IPSec VPN
I am trying to route traffic from a device (that I will call "target") connected to my Ubuntu box (that I will call "host") to servers at a remote office.
The host uses a Racoon IPSec VPN, connected ...
1
vote
2answers
314 views
Restrict access to Windows Terminal Services with dynamic IP address clients
In light of some recent worms I'm looking at ways to further restrict access to terminal services on my public facing Win2k3 server. Are firewall IP address restriction is not an option as the genuine ...
0
votes
0answers
351 views
Route based IPSec VPN Between IOS and ASA
I'd like to do a route based VPN between two sites. The purpose of this is to get remote site traffic passing through a transparent gateway at the headend, instead of using a proxy.
So currently it ...
1
vote
1answer
607 views
How can I create a host to host IPsec VPN if my server has direct Internet access and no LAN?
I have a Linux server (CentOS 5.5) that has direct access to the Internet with a fixed IP address. That is, the IP address is 200.29.X.Y. The gateway was given by the datacenter (200.29.X.Z) and the ...
0
votes
1answer
137 views
openswan installation
on a Linux machine with kernel 2.6.32, how to enable klips
i found that for enable klips mus enable
CONFIG_KLIPS_ALG=y
in kernel config.
but patch only available for 2.6.23- and for newer kernels, ...
2
votes
2answers
413 views
Racoon on Linux - Initial packet loss
I have configured two Linux boxes so they automatically use a transport-level IPSec connection whenever they need to communicate. The configuration is based on Racoon with X509 authentication and the ...
4
votes
3answers
2k views
How to advertise routes to IPSec tunnels in OSPF using Cisco IOS
I have Cisco 1800 series router (running C181X-ADVIPSERVICESK9-M) with lots of IPSec tunnels. I want to add this router to OSPF and configure it to advertise routes to remote subnets accessible via ...
1
vote
0answers
164 views
Trouble connecting my server to a firefwall trough VPN
I have a server running Ubuntu and Openswan, but I'm not able to connect to the remote firewall. I hope that anybody can help me.
My ipsec.conf-file is as follows:
config setup
protostack=netkey
...
0
votes
1answer
1k views
Ipsec config problem // openswan
I try to configure Ipsec on server with openswan as client.
But receive error - possible, it's auth error.
What I wrote wrong in config ?
Thank you for answers.
#1: STATE_MAIN_I2: ...
3
votes
1answer
1k views
Is there a way of setting an MTU lower for traffic destined to a specific IP address on Cisco ASA?
I have a number of VPN sites where the MTU is lower than standard (1500). I have had at least one site where fragmentation of packets has had an effect on the success of building an IPSEC tunnel.
...
0
votes
2answers
231 views
How do I load the dummy network adapter in linux if it's not as a module?
I want to build a roadwarrior ipsec gateway for routing traffic securely through my server.
For this, I plan to use racooon and debian linux. I have a VPS with a monolithic kernel (no kernel ...
0
votes
1answer
275 views
Windows 2008 R2 vpn tunnel to DD-WRT
I've DD-WRT router in one location with all servers (Windows 2008 R2) and workstations. In hosting I have Windows 2008 R2 Server with public IP address.
I need to setup permanent VPN connection so ...
2
votes
0answers
354 views
Getting ipsec-tools to work between Ubuntu Lucid hosts
I have two hosts, one is Charity with IP 67.207.128.184, the other is Hope with IP 67.207.130.204. I've installed the ipsec-tools package on each host. I have not installed racoon on either host. ...
2
votes
3answers
530 views
arp table filling up
I have a CentOS 5 system which serves as an IPSec VPN connector between my network and a couple of remote networks. Lately it is running into this problem once or twice a day where its ARP cache gets ...
0
votes
1answer
225 views
Cisco AnyConnect or IPSec user/ip authentication restriction
I'm trying to restrict some users from authenticating and accessing the VPN from home.
I have a Cisco ASA5505, they use AnyConnect or IPSec, and I only want them to gain access to the VPN when ...
1
vote
1answer
532 views
Is turning off Perfect Forward Secrecy a security threat?
I had to disable PFS in the IPsec rules on one of our ASAs to allow Android Gingerbread clients to connect. Does doing so compromise the security of the VPN? Communications are AES-256 or AES-128 with ...
1
vote
0answers
297 views
IPsec tunnels between Linux and Solaris
I have a Solaris machine sitting out in the ether somewhere that I would like to make part of my network via IPsec. I have this working between Solaris machines but not between Solaris and Linux.
I ...
0
votes
1answer
2k views
Gingerbread's IPsec client and Cisco ASA
Android Gingerbread has added support for true IPsec VPN, and I'm trying to get this to work with my Cisco ASA 5510 appliance. On the device, I've selected PSK v1 with Xauth as the connection method. ...
-1
votes
1answer
391 views
Site-to-site VPN with multiple WAN links
I want to set up a site-to-site VPN using multiple ISPs and WAN links, such that all traffic to/from site A goes via site B, and the implementation details are completely transparent to the LAN at ...
0
votes
0answers
165 views
Allow traffic from single IP address (server), block all other addresses
I'm trying to implement an IPSec policy that will block all the inbout traffic to port TCP 1433 (sql server 2008), but I need to allow the server itself to be able to connect to that port.
I have ...
4
votes
4answers
2k views
Cisco ASA 5505 - need more site-to-site VPNs
I'm using a Cisco ASA 5505 50-user firewall in a co-location facility. The systems at this location are performing monitoring of additional remote sites (also running Pix or ASA devices) I've ...
1
vote
2answers
793 views
L2TP/IPSec PreShared Key VPN
I tried to setup a L2TP/IPsec VPN server with PSK authentication according to this tutorial on a Ubuntu server but there is a problem when I'm trying to connect to this server with a Windows 7 client. ...
0
votes
1answer
166 views
Can a CISCO PIX tunnel SCTP traffic over an IPSEC tunnel
Can a cisco PIX 515e tunnel SCTP traffic over an IPSEC tunnel ?
I Know that the PIX doesn't support SCTP connection's but SCTP is still IP so i'm hoping the PIX has the capability to route SCTP over ...
1
vote
1answer
720 views
OSX 10.6 Cisco IPSEC strange behavior
I'm trying to connect to Cisco IPSEC VPN of my company over DSL Internet. I managed to successfully connect using Cisco VPN Client, now I'm trying to switch to OSX 10.6 native client, because of ...
3
votes
3answers
2k views
What might prevent IKE handshake success in building an IPSEC tunnel?
We use Cisco ASA for our IPSEC VPNs, using the EZVPN method. From time to time we encounter problems where an ISP has made a change to their network and our VPN stops working. Nine times out of ten ...
0
votes
2answers
2k views
What can an ISP do to block IPSEC traffic?
Every so often we encounter a problem where we cannot get an IPSEC VPN tunnel to work. Sometimes we know the local authorities restrict use of IPSEC (e.g. Bangladesh), and have to get some kind of ...
0
votes
1answer
497 views
OpenSWAN KLIPS not working
I am trying to setup IPSec between 2 VM launched by OpenNebula. I'm using OpenSWAN for that. This is the ipsec.conf file
config setup
oe=off
interfaces=%defaultroute
...
2
votes
0answers
1k views
Issue routing openswan vpn traffic beyond the server
Trying to set up a openswan based server sitting in an Amazon VPC cluster. The goal is to make it so we can VPN into VPC and have our workstations be as if they were on the network, more of a ...
0
votes
1answer
392 views
Server-to-server (Linux) VPN best practices?
I manage several CentOS and Fedora VMs, and our setup is getting sufficiently sophisticated that it's time to move several resources on a single back-end VM, and serve those out to our Web VM, QA VM, ...
0
votes
1answer
753 views
LAN to LAN (Tunnel) VPN with IPSec
I'm having some issues setting up a LAN-to-LAN VPN.
Please keep in mind, that "the other side" won't change anything in their configuration.
This is my current setup:
Our side:
Router: Draytek 2820 ...
1
vote
1answer
981 views
IPSec VPN between Amazon VPC and a Watchguard XTM?
I have a branch office behind a Watchguard XTM that needs VPN into an EC2 VPC. I am unfamiliar with Watchguard and am unable to find all of the knobs and dials in the flash admin interface to bring it ...
0
votes
1answer
208 views
IP Filter keeps blocking connection
I'm trying to connect from a web app to another web app using the WCF.NET NET-TCP protocol. This net.tcp protocol is enabled in IIS and is using the port TCP 808 in my case.
I've configured IP Filter ...
1
vote
2answers
502 views
IPSec with PSK under Win Server 2k8 R2
I'm trying to connect a Win Server 2k8 R2 system to a remote machine via IPSec. For this, I got the following settings from the other party:
Phase 1: PSK, AES256, SHA-1 Group 2
Phase 2: AES256, ...
1
vote
0answers
114 views
Windows IPSec Filter Sanity Check
I'm installing NSClient++ so our Nagios system can monitor some windows servers using NRPE. I need to punch a hole in our IPSec policy to allow inbound connections on port 5666 from the Nagios server.
...
0
votes
1answer
775 views
How to configure IPsec to limit RDP
I've seen plenty of people suggesting that you can limit RDP access to a range of IP addresses by using IPsec instead of using the built in Windows Firewall. This is exactly what I need to be able to ...
4
votes
3answers
217 views
How to lock down a Windows 2008 Server before connecting it to the internet
We're a very small company, about to install a new server at a colocation company. The plan is to install the OS, SQL, and IIS, test it, then courier it to the hosting company. It will then ...
