Tag Info

Hot answers tagged

1

Duplicate your existing P2 (click the + to the right of it), change local from 10.0.2.0/24, leaving same 10.172.0.0/16 remote. Do the same, flipping local and remote, on "other router." Then you'll be able to communicate between.


1

If you didn't tweak MTU, you may have post-fragmentation issues (fragmentation occuring after encryption) that is well explained in this documentation: http://www.cisco.com/c/en/us/td/docs/interfaces_modules/services_modules/vspa/configuration/guide/ivmsw_book/ivmvpnb.html#wp2047965 You should try to reduce MTU inside the tunnel by 82 bytes (GRE + IPSec ...


1

Yup, ZScaler would fit your requirements nicely. they have a Security as as Software "SaaS" solution that you could use to route your traffic to them first, and then to the internet. https://www.zscaler.com/


1

This is my working config: ipsec.conf: conn rw-ikev1 left=%any leftsubnet=0.0.0.0/0,::0/0 leftauth=pubkey leftcert="hubud2.pem" leftid=@xxx.atw.hu right=%any rightauth=pubkey rightauth2=xauth-radius rightgroups="cn=vpn_users_trusted/ou=roles/dc=y7/dc=hu" rightsourceip=192.168.100.0/28,2a01:270:1035:ff::/120 ...


1

I went throught this article to get a better understanding of what your configuration is. Your local computer (or the server from which the tunnel will be initiated) should be listed in "Endpoint 1" as well "local Tunnel Computer". The "remote tunnel computer" box should have the IP address of your router where the tunnel is terminated. The servers that you ...


1

How could strongSwan possibly do this at that point? A preliminary configuration is selected based on the IP addresses (left|right) and the IKE version. The best match (or the first if multiple configurations match equally well) is used until the identities in the IKE_AUTH exchange are available. Using the identities a switch to a different connection ...


1

left = local is the default. Only if an IP or resolved FQDN defined in right matches a local IP will the sides be switched. The left|right distinction is a legacy from FreeS/WAN and obviously mostly useful in site-to-site and host-to-host scenarios. An alternative is to use a VICI / swanctl based config, which allows to clearly specify local and remote ...



Only top voted, non community-wiki answers of a minimum length are eligible