IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.

learn more… | top users | synonyms

27
votes
8answers
48k views

OpenVPN vs. IPSec - Pros and Cons, what to use?

Interestingly I have not found any good search results when searching for "OpenVPN vs IPSec". So here my question: I need to setup a private LAN over an untrusted network. And as far as I know, both ...
21
votes
4answers
6k views

Is data always encrypted in IPv6 communications?

I can't seem to get a straight answer to this quesion. Wikipedia says "IPsec is an integral part of the base protocol suite in IPv6," but does that mean that ALL communications are always encrypted, ...
17
votes
1answer
35k views

How to set up strongswan or openswan for pure IPSEC with iPhone client?

I'm having trouble finding concrete, up-to-date information for how to set up strongswan or openswan to be used by the iphone's VPN client. My server is behind a budget linksys NAT router. I found ...
14
votes
2answers
3k views

When would you use MPLS?

After having just spent months setting up a fairly complex VPN, I'm beginning to look at alternatives for the future. Some of my network providers use MPLS to connect to us, and I suppose it works ...
12
votes
2answers
886 views

What's the protocol-level difference between IPSec and “Cisco IPSec”?

Most VPN clients distinguish between IPSec and "Cisco IPSec." For example, (Apple's) iOS treats them as essentially separate things. But I can't find any explanation of what the protocol-level ...
11
votes
5answers
8k views

Security of PPTP vs IPSec

Is PPTP or IPSEC VPN more secure than the other for 'dial in' VPN, if so, why?
8
votes
1answer
234 views

If IPSec has its own IP tunnel support why do some add LT2P to the stack?

I understand that you can use IPSec to tunnel data securely. According to the Wikipedia page and a few other sources it can also tunnel IP packets and then route them through an interface. That would ...
7
votes
8answers
9k views

Alternative Cisco VPN clients for Windows XP

I'm considering investing in a Cisco ASA5505. As Cisco's own VPN client requires a service subscription, which I am trying to do without, are there any free or low-cost ipsec VPN clients that will ...
7
votes
1answer
8k views

strongswan vs openswan

What's the differences between OpenSwan and StrongSwan? All I found is compartation between outdated FreeSwan and testing version of OpenSwan - i.e. current stable of OpenSwan is 2.6 (3.0 is ...
7
votes
2answers
3k views

IPSec VPN between Amazon VPC and Linux Server

I'm trying to set up an IPSec VPN connection between our corporate network and Amazon's Virtual Private Cloud, using their VPN system and a Linux server. Unfortunately, the only guide I've found ...
7
votes
3answers
5k views

IPSec for LAN traffic: Basic considerations?

This is a follow-up to my Encrypting absolutely everything... question. Important: This is not about the more usual IPSec setup, where you want to encrypt traffic between two LANs. My basic goal is ...
6
votes
1answer
173 views

Bypassing an Active Directory assigned IPSEC policy

I was in the process of translating some locally defined IPSEC policies on my test systems into group policies. In the process I applied an incomplete policy which was missing the line that allows ...
6
votes
1answer
3k views

ASA site-to-site IPSec vpn to linux ipsec-tools endpoints stops working after a random period of time

We swapped to ASA's over the weekend, and we replaced our VPN infrastructure which was previously based on openvpn and are now using IPSec between our ASA 5520's and our other sites that have linux ...
5
votes
1answer
27k views

IPsec VPN site-to-site: How should I configure the ipsec.conf files on both sites to get the tunnel up?

What I am trying to do is to create a site-to-site IPsec VPN between my network and my friend's network. We both have a router and two computers on each router, with all computers running Linux. So I ...
5
votes
1answer
1k views

With iptables, match packets arrived via IPSEC tunnel

I'm using IPSEC in a tunnel mode. How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive ...
5
votes
3answers
2k views

How do I route a public IP range over an IPSEC VPN?

So, I have an established IPSec Site to Site tunnel. Site A has a SonicWall, Site B has a EdgeRouter. The first tunnel consists of Site A's NATed ips to Site B's NATed ips. Everything works as ...
5
votes
1answer
847 views

Can I use Win 2k8 R2 as an IPSEC client?

I'm trying to connect a win server 2008 R2 box to a juniper ssg firewall using a client-to-gateway IPSEC VPN. I tried to set it up in Windows Firewall with Advanced Security, but the connection ...
5
votes
1answer
1k views

IPSec software that can use multiple CPU cores

Can anyone recommend a good IPSec software that can use multiple CPU cores to achieve performance ~2Gbps on Linux dual-CPU quad-core E5620 Xeon setup (total 16HT cores)? I have tried OpenSwan and ...
5
votes
2answers
582 views

ScreenOS ip6in4 tunnel over transport mode ipsec?

I have setup a point to point transport ipsec session between a ScreenOS router (SSG-5) and a Cisco 3925. The ipsec transport itself works great, but as soon as I try to direct the protocol 41 ...
5
votes
1answer
747 views

Windows Server 2003 IPSec Tunnel Connected, But Not Working (Possibly NAT/RRAS Related)

Configuration I have setup a "raw" IPSec tunnel between a Windows Server 2003 (SBS) machine and a Netgear FVG318 according to the instructions in Microsoft KB816514. The configuration is as follows ...
4
votes
3answers
288 views

How to lock down a Windows 2008 Server before connecting it to the internet

We're a very small company, about to install a new server at a colocation company. The plan is to install the OS, SQL, and IIS, test it, then courier it to the hosting company. It will then ...
4
votes
4answers
3k views

Cisco ASA 5505 - need more site-to-site VPNs

I'm using a Cisco ASA 5505 50-user firewall in a co-location facility. The systems at this location are performing monitoring of additional remote sites (also running Pix or ASA devices) I've ...
4
votes
3answers
771 views

How secure is a VPN connection over WiFi?

I travel a lot and connect to public wifi hotspots all the time. What information will be given out if I use VPN within public wifi hotspots? Will the owners or intruders in the hotspot be able to ...
4
votes
4answers
8k views

How can I speed up file transfers over VPN?

Our VPN users experience very slow file transfers (50MB can take 20 minutes with a 20Mbps FiOS connection on each side). If the file is transferred over HTTP or FTP, it's just as fast as you expect. I ...
4
votes
2answers
7k views

Connect to a Fortinet VPN with Ubuntu

I don't know a lot about VPNs but I'd like to connect to a Fortinet VPN with Ubuntu. I can connect on Windows using Forticlient just by entering the policy server (vpn.theserver.com) and then it asks ...
4
votes
2answers
6k views

How to make iPhone Cisco VPN client work with ASA with certificate authentication

I have an ASA that's providing IPsec VPN services using certificate authentication (no xauth, just the certs). It works perfectly with the Cisco IPsec VPN Client. Now I'm trying to let iPhones ...
4
votes
4answers
3k views

Wireshark and IPSec

I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point ...
4
votes
1answer
656 views

Cisco ASA ipsec IKEv1 remote access for Avaya VPN phone - no client address assigned

I'm having a strange issue with remote access VPN connectivity on our ASA cluster. Normal site-to-site tunnels and AnyConnect connections works just fine. However, a special ipsec ikev1 tunnel does ...
4
votes
2answers
328 views

Best security practice for small networks - wifi, lan,

We regularly setup small networks for clients in different locations to allow them to work on different products now the question what should be the best security practice. Currently we have a wifi ...
4
votes
2answers
4k views

iOS/Mac-Compatible IPSec VPN Server on Ubuntu

I pay for a VPS from a Xen VPS host and the load on it is fairly light, so I'd like to run a VPN off of it. The configuration I'm shooting for is "roadwarrior"-style, as I'd like to use it to secure ...
4
votes
2answers
907 views

IPSec with EC2 instance

Is it possible to setup an IPSec connection between my linux machine and a linux Ec2 instance? I can see the public IP address of EC2 but there is no interface listed in the instance associated with ...
4
votes
4answers
3k views

Cisco PIX 515e dropping IPSEC tunnels to ASA 5505 over time

We have a Head-Office/Branch-Office WAN like this, Server LAN <-> Cisco PIX 515e <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 1 <-VPN tunnel-> ...
4
votes
2answers
1k views

IPSec VPN on Vista

My company uses IPCop to configure it's VPN. We have an IPSec script that runs on Windows XP to open a connection using a security certificate for authentication. Microsoft totally changed things ...
4
votes
2answers
327 views

TCP connection through IPSec (Linux/Strongswan) stalls after exceeding PMTU

The backups (via Bacula) of one of my servers (“A”) connected via IPSec (Strongswan on Debian testing) to a storage daemon (“B”) don't finish 95% of the times they run. What apparently happens, is: ...
4
votes
1answer
213 views

Windows Firewall IPSec configuration, how to protect the AD

Here's my infrastructure configuration: All servers have public IP I've setup a GPO to enable IPSec on everyone of them with a "require for inbound and request for outbound" rule, for all server, ...
4
votes
3answers
4k views

How to advertise routes to IPSec tunnels in OSPF using Cisco IOS

I have Cisco 1800 series router (running C181X-ADVIPSERVICESK9-M) with lots of IPSec tunnels. I want to add this router to OSPF and configure it to advertise routes to remote subnets accessible via ...
4
votes
2answers
3k views

Windows 7 VPN Client Default IPsec Configuration?

I'd like to use the windows vpn client for client-site vpn to my linksys rv042. As far as I can tell, the windows VPN client doesn't provide a lot of flexibility in its IPsec settings. Assuming full ...
4
votes
2answers
1k views

IPSec tunnel on ASA keeps disconnecting

I have an ASA IPSec tunnel configured between an ASA5505 and Microsoft TMG 2010 SP2. The tunnel sometimes works for a few hours, and then disconnects, and other times it works for 5 minutes and then ...
4
votes
2answers
276 views

Implementing an isolated guest WLAN via IPSec VPN on Windows

We are attempting to set up a guest WLAN network that is isolated from the rest of our network. This is proving difficult due to a couple of technical reasons. My first choice was to use a separate ...
4
votes
1answer
3k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
4
votes
1answer
2k views

Issue routing openswan vpn traffic beyond the server

Trying to set up a openswan based server sitting in an Amazon VPC cluster. The goal is to make it so we can VPN into VPC and have our workstations be as if they were on the network, more of a ...
3
votes
5answers
520 views

The right vpn to replace heavy ssh usage

We are a small development firm looking to access the following services remotely: http smb network shares rdc / vnc Currently we do this with a lot of ssh tunnels. We are looking into switching ...
3
votes
2answers
2k views

Is it possible for L2TP VPN to do auto route configuration for client during connected?

We've setup a L2TP VPN server with this tutorial, everything works like a charm. The only issue is We don't want client to route all traffic using this VPN, only a particular subnet, e.g. ...
3
votes
1answer
2k views

strongSwan IPsec server with AWS EC2 VPC VPN client

I'm trying to create a VPN tunnel between 2 AWS regions. The way I'm trying to do this is by setting up a IPsec server in Linux with strongSwan in one region, and then a VPC VPN in the other region. ...
3
votes
2answers
8k views

Simple L2TP/IPsec server not working (openswan, xl2tpd, Ubuntu, Windows)

I configured openswan and xl2tpd on an Ubuntu 12.04 server (on EC2) by following various tutorials/documentation which seem to largely say the same things, but most recently this one. However, my ...
3
votes
1answer
744 views

IPSec L2L Failover between two pfSense devices

Is it possible to achieve IPSec L2L failover (ie, from one WAN interface to another) between two pfSense devices using Gateway Groups, or really anything other than defining multiple IPSec connections ...
3
votes
1answer
2k views

Juniper SSG 5 VPN

I have a host who set up our Juniper SSG 5 VPN with Firmware version-6.2.0r5.0 I've been trying to set up VPN on it using this guide: http://kb.juniper.net/InfoCenter/index?page=content&id=KB4094 ...
3
votes
1answer
2k views

Allow traffic from single IP address, block all other addresses

I have a server running Windows Server 2003. I want to only allow traffic from my IP address and block all other traffic from all other addresses. I'd like to know how to correctly configure this IP ...
3
votes
1answer
63 views

Can I have an alert when a IPSEC is down in Fortigate 80C?

We have a fortigate 80c and 60D with an IPSEC VPN . Is there a way to use the log (or other tool) to send an email alert when the tunnel is down? I couldn't see anything on the Log & Report tab
3
votes
2answers
357 views

Windows Advanced Firewall - adding Authorized Computers breaks rule

How can adding a 'only allow connections to these computers' setting in an an otherwise working IPSec rule break connectivity? Background: I'm setting up a basic set of client rules that restrict ...