IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.

learn more… | top users | synonyms

23
votes
8answers
43k views

OpenVPN vs. IPSec - Pros and Cons, what to use?

interestingly I have not found any good searchresults when searching for "OpenVPN vs IPSec": I need to setup a private LAN over an untrusted network. And as far as I know, both approaces seem to be ...
20
votes
4answers
5k views

Is data always encrypted in IPv6 communications?

I can't seem to get a straight answer to this quesion. Wikipedia says "IPsec is an integral part of the base protocol suite in IPv6," but does that mean that ALL communications are always encrypted, ...
15
votes
1answer
32k views

How to set up strongswan or openswan for pure IPSEC with iPhone client?

I'm having trouble finding concrete, up-to-date information for how to set up strongswan or openswan to be used by the iphone's VPN client. My server is behind a budget linksys NAT router. I found ...
14
votes
2answers
3k views

When would you use MPLS?

After having just spent months setting up a fairly complex VPN, I'm beginning to look at alternatives for the future. Some of my network providers use MPLS to connect to us, and I suppose it works ...
11
votes
5answers
8k views

Security of PPTP vs IPSec

Is PPTP or IPSEC VPN more secure than the other for 'dial in' VPN, if so, why?
11
votes
2answers
795 views

What's the protocol-level difference between IPSec and “Cisco IPSec”?

Most VPN clients distinguish between IPSec and "Cisco IPSec." For example, (Apple's) iOS treats them as essentially separate things. But I can't find any explanation of what the protocol-level ...
8
votes
1answer
228 views

If IPSec has its own IP tunnel support why do some add LT2P to the stack?

I understand that you can use IPSec to tunnel data securely. According to the Wikipedia page and a few other sources it can also tunnel IP packets and then route them through an interface. That would ...
7
votes
8answers
8k views

Alternative Cisco VPN clients for Windows XP

I'm considering investing in a Cisco ASA5505. As Cisco's own VPN client requires a service subscription, which I am trying to do without, are there any free or low-cost ipsec VPN clients that will ...
7
votes
1answer
6k views

strongswan vs openswan

What's the differences between OpenSwan and StrongSwan? All I found is compartation between outdated FreeSwan and testing version of OpenSwan - i.e. current stable of OpenSwan is 2.6 (3.0 is ...
7
votes
2answers
2k views

IPSec VPN between Amazon VPC and Linux Server

I'm trying to set up an IPSec VPN connection between our corporate network and Amazon's Virtual Private Cloud, using their VPN system and a Linux server. Unfortunately, the only guide I've found ...
6
votes
1answer
162 views

Bypassing an Active Directory assigned IPSEC policy

I was in the process of translating some locally defined IPSEC policies on my test systems into group policies. In the process I applied an incomplete policy which was missing the line that allows ...
6
votes
3answers
4k views

IPSec for LAN traffic: Basic considerations?

This is a follow-up to my Encrypting absolutely everything... question. Important: This is not about the more usual IPSec setup, where you want to encrypt traffic between two LANs. My basic goal is ...
5
votes
1answer
742 views

With iptables, match packets arrived via IPSEC tunnel

I'm using IPSEC in a tunnel mode. How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive ...
5
votes
2answers
1k views

How do I route a public IP range over an IPSEC VPN?

So, I have an established IPSec Site to Site tunnel. Site A has a SonicWall, Site B has a EdgeRouter. The first tunnel consists of Site A's NATed ips to Site B's NATed ips. Everything works as ...
5
votes
1answer
3k views

ASA site-to-site IPSec vpn to linux ipsec-tools endpoints stops working after a random period of time

We swapped to ASA's over the weekend, and we replaced our VPN infrastructure which was previously based on openvpn and are now using IPSec between our ASA 5520's and our other sites that have linux ...
5
votes
1answer
679 views

Can I use Win 2k8 R2 as an IPSEC client?

I'm trying to connect a win server 2008 R2 box to a juniper ssg firewall using a client-to-gateway IPSEC VPN. I tried to set it up in Windows Firewall with Advanced Security, but the connection ...
5
votes
1answer
942 views

IPSec software that can use multiple CPU cores

Can anyone recommend a good IPSec software that can use multiple CPU cores to achieve performance ~2Gbps on Linux dual-CPU quad-core E5620 Xeon setup (total 16HT cores)? I have tried OpenSwan and ...
5
votes
2answers
554 views

ScreenOS ip6in4 tunnel over transport mode ipsec?

I have setup a point to point transport ipsec session between a ScreenOS router (SSG-5) and a Cisco 3925. The ipsec transport itself works great, but as soon as I try to direct the protocol 41 ...
4
votes
3answers
272 views

How to lock down a Windows 2008 Server before connecting it to the internet

We're a very small company, about to install a new server at a colocation company. The plan is to install the OS, SQL, and IIS, test it, then courier it to the hosting company. It will then ...
4
votes
4answers
2k views

Cisco ASA 5505 - need more site-to-site VPNs

I'm using a Cisco ASA 5505 50-user firewall in a co-location facility. The systems at this location are performing monitoring of additional remote sites (also running Pix or ASA devices) I've ...
4
votes
3answers
740 views

How secure is a VPN connection over WiFi?

I travel a lot and connect to public wifi hotspots all the time. What information will be given out if I use VPN within public wifi hotspots? Will the owners or intruders in the hotspot be able to ...
4
votes
4answers
7k views

How can I speed up file transfers over VPN?

Our VPN users experience very slow file transfers (50MB can take 20 minutes with a 20Mbps FiOS connection on each side). If the file is transferred over HTTP or FTP, it's just as fast as you expect. I ...
4
votes
2answers
6k views

Connect to a Fortinet VPN with Ubuntu

I don't know a lot about VPNs but I'd like to connect to a Fortinet VPN with Ubuntu. I can connect on Windows using Forticlient just by entering the policy server (vpn.theserver.com) and then it asks ...
4
votes
2answers
6k views

How to make iPhone Cisco VPN client work with ASA with certificate authentication

I have an ASA that's providing IPsec VPN services using certificate authentication (no xauth, just the certs). It works perfectly with the Cisco IPsec VPN Client. Now I'm trying to let iPhones ...
4
votes
4answers
2k views

Wireshark and IPSec

I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point ...
4
votes
1answer
527 views

Cisco ASA ipsec IKEv1 remote access for Avaya VPN phone - no client address assigned

I'm having a strange issue with remote access VPN connectivity on our ASA cluster. Normal site-to-site tunnels and AnyConnect connections works just fine. However, a special ipsec ikev1 tunnel does ...
4
votes
2answers
280 views

Best security practice for small networks - wifi, lan,

We regularly setup small networks for clients in different locations to allow them to work on different products now the question what should be the best security practice. Currently we have a wifi ...
4
votes
2answers
3k views

iOS/Mac-Compatible IPSec VPN Server on Ubuntu

I pay for a VPS from a Xen VPS host and the load on it is fairly light, so I'd like to run a VPN off of it. The configuration I'm shooting for is "roadwarrior"-style, as I'd like to use it to secure ...
4
votes
2answers
832 views

IPSec with EC2 instance

Is it possible to setup an IPSec connection between my linux machine and a linux Ec2 instance? I can see the public IP address of EC2 but there is no interface listed in the instance associated with ...
4
votes
4answers
2k views

Cisco PIX 515e dropping IPSEC tunnels to ASA 5505 over time

We have a Head-Office/Branch-Office WAN like this, Server LAN <-> Cisco PIX 515e <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 1 <-VPN tunnel-> ...
4
votes
2answers
1k views

IPSec VPN on Vista

My company uses IPCop to configure it's VPN. We have an IPSec script that runs on Windows XP to open a connection using a security certificate for authentication. Microsoft totally changed things ...
4
votes
1answer
272 views

Cisco QuickVPN Can't view local computers

I am connected to my QuickVPN connection to my RV180 VPN Router and I can access the router via IP but I can't find or see any of the computers. How can I fix that? Do I need to do some more advanced ...
4
votes
3answers
3k views

How to advertise routes to IPSec tunnels in OSPF using Cisco IOS

I have Cisco 1800 series router (running C181X-ADVIPSERVICESK9-M) with lots of IPSec tunnels. I want to add this router to OSPF and configure it to advertise routes to remote subnets accessible via ...
4
votes
2answers
3k views

Windows 7 VPN Client Default IPsec Configuration?

I'd like to use the windows vpn client for client-site vpn to my linksys rv042. As far as I can tell, the windows VPN client doesn't provide a lot of flexibility in its IPsec settings. Assuming full ...
4
votes
2answers
438 views

IPSec tunnel on ASA keeps disconnecting

I have an ASA IPSec tunnel configured between an ASA5505 and Microsoft TMG 2010 SP2. The tunnel sometimes works for a few hours, and then disconnects, and other times it works for 5 minutes and then ...
4
votes
2answers
255 views

Implementing an isolated guest WLAN via IPSec VPN on Windows

We are attempting to set up a guest WLAN network that is isolated from the rest of our network. This is proving difficult due to a couple of technical reasons. My first choice was to use a separate ...
4
votes
1answer
2k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
4
votes
1answer
711 views

Windows Server 2003 IPSec Tunnel Connected, But Not Working (Possibly NAT/RRAS Related)

Configuration I have setup a "raw" IPSec tunnel between a Windows Server 2003 (SBS) machine and a Netgear FVG318 according to the instructions in Microsoft KB816514. The configuration is as follows ...
3
votes
1answer
22k views

IPsec VPN site-to-site: How should I configure the ipsec.conf files on both sites to get the tunnel up?

What I am trying to do is to create a site-to-site IPsec VPN between my network and my friend's network. We both have a router and two computers on each router, with all computers running Linux. So I ...
3
votes
5answers
514 views

The right vpn to replace heavy ssh usage

We are a small development firm looking to access the following services remotely: http smb network shares rdc / vnc Currently we do this with a lot of ssh tunnels. We are looking into switching ...
3
votes
2answers
730 views

Is it possible for L2TP VPN to do auto route configuration for client during connected?

We've setup a L2TP VPN server with this tutorial, everything works like a charm. The only issue is We don't want client to route all traffic using this VPN, only a particular subnet, e.g. ...
3
votes
1answer
527 views

IPSec L2L Failover between two pfSense devices

Is it possible to achieve IPSec L2L failover (ie, from one WAN interface to another) between two pfSense devices using Gateway Groups, or really anything other than defining multiple IPSec connections ...
3
votes
2answers
6k views

Simple L2TP/IPsec server not working (openswan, xl2tpd, Ubuntu, Windows)

I configured openswan and xl2tpd on an Ubuntu 12.04 server (on EC2) by following various tutorials/documentation which seem to largely say the same things, but most recently this one. However, my ...
3
votes
1answer
2k views

Allow traffic from single IP address, block all other addresses

I have a server running Windows Server 2003. I want to only allow traffic from my IP address and block all other traffic from all other addresses. I'd like to know how to correctly configure this IP ...
3
votes
2answers
242 views

Windows Advanced Firewall - adding Authorized Computers breaks rule

How can adding a 'only allow connections to these computers' setting in an an otherwise working IPSec rule break connectivity? Background: I'm setting up a basic set of client rules that restrict ...
3
votes
3answers
2k views

How do I encrypt SQL Server traffic with IPSEC?

I've found all sorts of documentation on what IPSEC is and how to (in very non-specific ways) configure it, but I can't seem to configure a Windows Firewall With Advanced Security rule that both A) ...
3
votes
1answer
377 views

What is the difference between “Main” mode and “Quick” mode when using IPsec in Windows Server?

What is the difference between “Main” mode and “Quick” mode when using IPsec in Windows Server? When does each one come into play?
3
votes
1answer
134 views

terminate ipsec transport at firewall?

I am exploring using ipsec transport mode to provide secure ipv6 access between 2 LANs and several remote users. I love the combo of a flat ipv6 global unicast address space combined with ipv6 ...
3
votes
1answer
6k views

StrongSwan ipsec ubuntu “ignoring informational payload, type NO_PROPOSAL_CHOSEN”

I have StrongSwan running on a ubuntu server and I'm trying to create an ipsec encrypted VPN tunnel with a Cisco 2821 router . The connection is not working and I cannot figure out why. It appears ...
3
votes
1answer
2k views

VPN connection between Endian firewall and Android phones

We have an endian firewall (community, 2.4.0) as gateway, which is already serving as OpenVPN and IPSec endpoint (net-to-net). And we have many Android phones (most of them running Android 2.2 FroYo). ...