IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.

learn more… | top users | synonyms

51
votes
7answers
71k views

OpenVPN vs. IPSec - Pros and Cons, what to use?

Interestingly I have not found any good search results when searching for "OpenVPN vs IPSec". So here my question: I need to setup a private LAN over an untrusted network. And as far as I know, both ...
24
votes
4answers
10k views

Is data always encrypted in IPv6 communications?

I can't seem to get a straight answer to this quesion. Wikipedia says "IPsec is an integral part of the base protocol suite in IPv6," but does that mean that ALL communications are always encrypted, ...
19
votes
1answer
42k views

How to set up strongswan or openswan for pure IPSEC with iPhone client?

I'm having trouble finding concrete, up-to-date information for how to set up strongswan or openswan to be used by the iphone's VPN client. My server is behind a budget linksys NAT router. I found ...
16
votes
2answers
21k views

strongswan vs openswan

What's the differences between OpenSwan and StrongSwan? All I found is compartation between outdated FreeSwan and testing version of OpenSwan - i.e. current stable of OpenSwan is 2.6 (3.0 is ...
14
votes
2answers
4k views

When would you use MPLS?

After having just spent months setting up a fairly complex VPN, I'm beginning to look at alternatives for the future. Some of my network providers use MPLS to connect to us, and I suppose it works ...
12
votes
2answers
1k views

What's the protocol-level difference between IPSec and “Cisco IPSec”?

Most VPN clients distinguish between IPSec and "Cisco IPSec." For example, (Apple's) iOS treats them as essentially separate things. But I can't find any explanation of what the protocol-level ...
11
votes
5answers
10k views

Security of PPTP vs IPSec

Is PPTP or IPSEC VPN more secure than the other for 'dial in' VPN, if so, why?
10
votes
2answers
621 views

20Mbps WAN limited to 10Mbps over IPSec Tunnel

We recently upgraded a remote site from a 10/10Mbps fibre to a 20/20Mbps fibre link (it is fibre to the basement, then VDSL from the basement to the office, roughly 30 meters). There are regular large ...
9
votes
1answer
4k views

With iptables, match packets arrived via IPSEC tunnel

I'm using IPSEC in a tunnel mode. How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive ...
8
votes
1answer
260 views

If IPSec has its own IP tunnel support why do some add LT2P to the stack?

I understand that you can use IPSec to tunnel data securely. According to the Wikipedia page and a few other sources it can also tunnel IP packets and then route them through an interface. That would ...
7
votes
7answers
11k views

Alternative Cisco VPN clients for Windows XP

I'm considering investing in a Cisco ASA5505. As Cisco's own VPN client requires a service subscription, which I am trying to do without, are there any free or low-cost ipsec VPN clients that will ...
7
votes
2answers
4k views

IPSec VPN between Amazon VPC and Linux Server

I'm trying to set up an IPSec VPN connection between our corporate network and Amazon's Virtual Private Cloud, using their VPN system and a Linux server. Unfortunately, the only guide I've found ...
7
votes
3answers
7k views

IPSec for LAN traffic: Basic considerations?

This is a follow-up to my Encrypting absolutely everything... question. Important: This is not about the more usual IPSec setup, where you want to encrypt traffic between two LANs. My basic goal is ...
6
votes
1answer
4k views

strongSwan IPsec server with AWS EC2 VPC VPN client

I'm trying to create a VPN tunnel between 2 AWS regions. The way I'm trying to do this is by setting up a IPsec server in Linux with strongSwan in one region, and then a VPC VPN in the other region. ...
6
votes
1answer
227 views

Bypassing an Active Directory assigned IPSEC policy

I was in the process of translating some locally defined IPSEC policies on my test systems into group policies. In the process I applied an incomplete policy which was missing the line that allows ...
6
votes
1answer
1k views

Simultaneous IKEv1 and IKEv2 connection support in Strongswan

I'm using Strongswan to handle IPsec connections, and need a way to support both Windows (IKEv2) and OS X (IKEv1) clients. I would prefer to use pure IPsec (i.e. avoid having to setup L2TP) unless ...
6
votes
1answer
4k views

ASA site-to-site IPSec vpn to linux ipsec-tools endpoints stops working after a random period of time

We swapped to ASA's over the weekend, and we replaced our VPN infrastructure which was previously based on openvpn and are now using IPSec between our ASA 5520's and our other sites that have linux ...
6
votes
1answer
1k views

Can I use Win 2k8 R2 as an IPSEC client?

I'm trying to connect a win server 2008 R2 box to a juniper ssg firewall using a client-to-gateway IPSEC VPN. I tried to set it up in Windows Firewall with Advanced Security, but the connection ...
6
votes
2answers
3k views

Issue routing openswan vpn traffic beyond the server

Trying to set up a openswan based server sitting in an Amazon VPC cluster. The goal is to make it so we can VPN into VPC and have our workstations be as if they were on the network, more of a ...
6
votes
1answer
2k views

IPSec software that can use multiple CPU cores

Can anyone recommend a good IPSec software that can use multiple CPU cores to achieve performance ~2Gbps on Linux dual-CPU quad-core E5620 Xeon setup (total 16HT cores)? I have tried OpenSwan and ...
6
votes
1answer
5k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
5
votes
1answer
44k views

IPsec VPN site-to-site: How should I configure the ipsec.conf files on both sites to get the tunnel up?

What I am trying to do is to create a site-to-site IPsec VPN between my network and my friend's network. We both have a router and two computers on each router, with all computers running Linux. So I ...
5
votes
3answers
9k views

ipsec verify on ubuntu Two or more interfaces found, checking IP forwarding [FAILED]

Ubuntu 14.04, Openswan U2.6.38/K3.13.0-30-generic When I run ipsec verify I get this error. Two or more interfaces found, checking IP forwarding [FAILED] I see quite a few of this same ...
5
votes
2answers
11k views

strongSwan IKEv2 + Windows 7 Agile VPN: What is causing Error 13801

I have an AWS instance that I want to be a VPN server. It will connect Windows 7 clients to a private network in the Amazon cloud. I have installed Ubuntu 12.04 and the strongswan-ikev2 package. ...
5
votes
3answers
4k views

How do I route a public IP range over an IPSEC VPN?

So, I have an established IPSec Site to Site tunnel. Site A has a SonicWall, Site B has a EdgeRouter. The first tunnel consists of Site A's NATed ips to Site B's NATed ips. Everything works as ...
5
votes
2answers
478 views

Best security practice for small networks - wifi, lan,

We regularly setup small networks for clients in different locations to allow them to work on different products now the question what should be the best security practice. Currently we have a wifi ...
5
votes
2answers
1k views

TCP connection through IPSec (Linux/Strongswan) stalls after exceeding PMTU

The backups (via Bacula) of one of my servers (“A”) connected via IPSec (Strongswan on Debian testing) to a storage daemon (“B”) don't finish 95% of the times they run. What apparently happens, is: ...
5
votes
1answer
412 views

Restrict access to RD Gateway based on IP

I'm trying to restrict who can access our RD Gateway based on both their group membership and IP address (so people in group A can only access the system from IP address X). The Network Policy Server ...
5
votes
1answer
664 views

IPSec + L2TP + NAT-Traversal does not work for multiple clients behind same nat

I have recently configured a VPN server hosted in AWS EC2. Details: Centos 6.4, openswan, xl2tpd, NAT-traversal. The configuration works great for a scenario when only one user connects form a given ...
5
votes
2answers
662 views

ScreenOS ip6in4 tunnel over transport mode ipsec?

I have setup a point to point transport ipsec session between a ScreenOS router (SSG-5) and a Cisco 3925. The ipsec transport itself works great, but as soon as I try to direct the protocol 41 ...
5
votes
1answer
837 views

Windows Server 2003 IPSec Tunnel Connected, But Not Working (Possibly NAT/RRAS Related)

Configuration I have setup a "raw" IPSec tunnel between a Windows Server 2003 (SBS) machine and a Netgear FVG318 according to the instructions in Microsoft KB816514. The configuration is as follows ...
4
votes
2answers
7k views

Is it possible for L2TP VPN to do auto route configuration for client during connected?

We've setup a L2TP VPN server with this tutorial, everything works like a charm. The only issue is We don't want client to route all traffic using this VPN, only a particular subnet, e.g. ...
4
votes
3answers
352 views

How to lock down a Windows 2008 Server before connecting it to the internet

We're a very small company, about to install a new server at a colocation company. The plan is to install the OS, SQL, and IIS, test it, then courier it to the hosting company. It will then ...
4
votes
4answers
4k views

Cisco ASA 5505 - need more site-to-site VPNs

I'm using a Cisco ASA 5505 50-user firewall in a co-location facility. The systems at this location are performing monitoring of additional remote sites (also running Pix or ASA devices) I've ...
4
votes
2answers
14k views

Which ports for IPSEC/LT2P?

I have a firewall/router (not doing NAT). I've googled and seen conflicting answers. It seems UDP 500 is the common one. But the others are confusing. 1701, 4500. And some say I need to also ...
4
votes
3answers
846 views

How secure is a VPN connection over WiFi?

I travel a lot and connect to public wifi hotspots all the time. What information will be given out if I use VPN within public wifi hotspots? Will the owners or intruders in the hotspot be able to ...
4
votes
4answers
11k views

How can I speed up file transfers over VPN?

Our VPN users experience very slow file transfers (50MB can take 20 minutes with a 20Mbps FiOS connection on each side). If the file is transferred over HTTP or FTP, it's just as fast as you expect. I ...
4
votes
2answers
10k views

Connect to a Fortinet VPN with Ubuntu

I don't know a lot about VPNs but I'd like to connect to a Fortinet VPN with Ubuntu. I can connect on Windows using Forticlient just by entering the policy server (vpn.theserver.com) and then it asks ...
4
votes
2answers
7k views

How to make iPhone Cisco VPN client work with ASA with certificate authentication

I have an ASA that's providing IPsec VPN services using certificate authentication (no xauth, just the certs). It works perfectly with the Cisco IPsec VPN Client. Now I'm trying to let iPhones ...
4
votes
4answers
4k views

Wireshark and IPSec

I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point ...
4
votes
2answers
15k views

Simple L2TP/IPsec server not working (openswan, xl2tpd, Ubuntu, Windows)

I configured openswan and xl2tpd on an Ubuntu 12.04 server (on EC2) by following various tutorials/documentation which seem to largely say the same things, but most recently this one. However, my ...
4
votes
1answer
1k views

Cisco ASA ipsec IKEv1 remote access for Avaya VPN phone - no client address assigned

I'm having a strange issue with remote access VPN connectivity on our ASA cluster. Normal site-to-site tunnels and AnyConnect connections works just fine. However, a special ipsec ikev1 tunnel does ...
4
votes
1answer
3k views

Why are only 3 ip xfrm policies needed for a IPsec tunnel?

I have a site-to-site IPsec tunnel up and running between a strongswan (v5.2.0) instance (site A) and a RouterOS router (site B). Everything works fine, the hosts in the two private subnets setup for ...
4
votes
4answers
6k views

pfsense 2.0.2 racoon(ipsec vpn) unreliable

I'm having issues with racoon (ipsec VPN) on pFSense 2.0.2 (and 2.0.1). According to racoon all my tunnels are up (I have about 130 of them), but over time more and more of them won't pass traffic ...
4
votes
2answers
1k views

TCP Reverse Proxy through VPN

I have a rather odd situation, but it's simple, I swear. I have a server (we'll call it host A) that's connected up to the internet and I use for some websites and other odds and ends. I have another ...
4
votes
1answer
7k views

What is the difference between “Main” mode and “Quick” mode when using IPsec in Windows Server?

What is the difference between “Main” mode and “Quick” mode when using IPsec in Windows Server? When does each one come into play?
4
votes
1answer
601 views

Is it possible to connect two IPSec site-to-site VPNs to one Windows 2008 Server?

I need to connect to two IPSEC site to site vpns from a Windows 2008 Server at the same time. Is it posible? I tried to assign two IP Security Policies, but it seems I can only have one assigned at ...
4
votes
2answers
4k views

iOS/Mac-Compatible IPSec VPN Server on Ubuntu

I pay for a VPS from a Xen VPS host and the load on it is fairly light, so I'd like to run a VPN off of it. The configuration I'm shooting for is "roadwarrior"-style, as I'd like to use it to secure ...
4
votes
1answer
10k views

Multiple Set Peer for VPN Failover

I will have two Cisco routers at Location A serving the same internal networks, and one router in location B. Currently, I have one router in each location with a IPSec site-to-site tunnel connecting ...
4
votes
1answer
4k views

Site-to-Site IPsec vpn not sending ping across a tunnel

This is my first attempt at a site-to-site VPN. I chose to use IPec because it appeared to be the best solution for what I needed to accomplish. I've followed several different tutorials over the last ...