We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [ipsec]

IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.

341 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
2answers
7k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
5
votes
0answers
455 views

How to limit bandwidth per VPN connection?

I have a StrongSwan (IKEv2) server setup and would like to limit each VPN connection to 512kb/s. After researching I came across tc in Ubuntu. I don't quite understand it and am fighting through the ...
5
votes
0answers
907 views

IPSec bandwidth between two Pfsense hosts has predictable, variable bandwidth

I have a IPSec tunnel between two Pfsense machines. Both machines are connected to a 100mbps symmetrical connection. The latency between the two routers is ~70ms. I'm using AES-GCM-128 and SHA1, both ...
5
votes
1answer
2k views

IPSec + L2TP + NAT-Traversal does not work for multiple clients behind same nat

I have recently configured a VPN server hosted in AWS EC2. Details: Centos 6.4, openswan, xl2tpd, NAT-traversal. The configuration works great for a scenario when only one user connects form a given ...
5
votes
1answer
4k views

L2TP over IPSec VPN with OpenSwan and XL2TPD can't connect, timeout on Centos 6

I'm setting up LT2p over IPSec on my Centos 6.3 fresh install. I have iptables flushed, permit all. Whenever I try to connect, i get a 'no reply from vpn' and nothi Here's my ipsec.conf file (...
5
votes
0answers
569 views

Firewall “Connection Security” when there is no trust and NATing between the two computers

First a little explanation of my network topology. I have a internal domain, and edge network domain. There is no trust between the two domains (and IT will not allow a one way trust to be set up ...
5
votes
1answer
904 views

Windows Server 2003 IPSec Tunnel Connected, But Not Working (Possibly NAT/RRAS Related)

Configuration I have setup a "raw" IPSec tunnel between a Windows Server 2003 (SBS) machine and a Netgear FVG318 according to the instructions in Microsoft KB816514. The configuration is as follows (...
4
votes
1answer
2k views

Why is scp so slow on my network?

SCP is slow in our company network. For testing, I am copying a file from a remote server which is connected via IPsec between the routers. When using scp -vv I get lots of messages like this: ...
4
votes
0answers
308 views

Cisco ASA ipsec vs Anyconnect client issue

So I have an iPad that has a IPSec VPN created. I am able to connect from the outside fine and I can access my local LAN files just fine. When I connect with the Cisco AnyConnect client from the same ...
4
votes
0answers
1k views

configuring IPsec with IPV6

I am working with racoon tool and ipsec-tools and I have been able to connect two devices with IPSEC working in transport mode. However, I did it with IPv4 addresses and when I change them to IPV6 ...
4
votes
0answers
1k views

How do I configure OpenSwan to allow pure IPsec (not L2TP) connections from an iPhone?

Similar to this question, I want to configure an IPsec server on Linux which will accept connections from the iPhone. However, unlike the other question, I want to be able to test with pre-shared keys ...
4
votes
0answers
680 views

Trying to get a new user up on pfSense IPSec VPN; Config file import failed, now getting gateway errors

Caveat: I am not a sysadmin, so please forgive the n00bness of the query. We have a new user and I'm trying to get them up on VPN. We use pfsense as an IPSEC endpoint. This person is using Shrewsoft ...
4
votes
2answers
2k views

Using Ubuntu Karmic as an L2TP Client for VPN

I'm trying to connect to a VPN service over L2TP using Karmic as a client and it's not working. The only details I have are the remote IP address, username & password, and a shared secret string; ...
3
votes
0answers
178 views

FreeBSD major update broke vpnc connectivity, incoming ESP traffic doesn't appear unencrypted on interfaces

I updated a FreeBSD box from 10.4 to 11.2-RELEASE-p4 recently and it seems to have broken the vpnc VPN connectivity. Here's the vpnc.conf: IPSec gateway 10.1.0.1 IPSec ID vpnuser IPSec secret ...
3
votes
1answer
2k views

IPSec strongswan “established successfully”, but no ppp0

I'm trying to connect an Ubuntu Server 16.04 to an IPSec L2TP VPN using the strongswan client. Aparently the connection is established successfully, but the interface ppp0 isn't created. This is the ...
3
votes
0answers
660 views

What is the ip xfrm tmpl and how is it different than an SA?

The Linux ip xfrm policy command creates an IPsec policy, associating particular traffic with an SA. It uses something called a "template" (tmpl), which, as far as I can tell, is just a means of ...
3
votes
0answers
280 views

Windows Firewall Connection Security, require encryption with IPv6?

I've set up Windows Firewall on a Server 2012 R2 to always require IPSec Encryption for all Connection Security Rules. I've then specified Inbound Rules for specific ports and services, and ...
3
votes
0answers
3k views

vpnc: no response from target

I have not be able to for a tunnel using vpnc or shrew soft to my pfsense box running IPSec. I have made sure that the correct ports are open, the user I'm trying to log in has the correct permissions ...
3
votes
1answer
2k views

Windows 7/8 Strongswan IKEv2 Wrong Gateway

I have setup Strongswan on Ubuntu 14.04 from the official package. I use IKEv2 with PKI authentication and a custom authorization plugin. This works great for Android and Ubuntu clients using ...
3
votes
0answers
6k views

Allowing LDAP authentication from DMZ to Active Directory. Is my idea secure?

I have a internet-facing application server that I want to use AD authentication. This is my first time doing this for a none MS application or without some sort of proxy. I already have a idea in my ...
3
votes
0answers
475 views

Having trouble installing Racoon and Strongswan on the same system

I have two applications that I need to run, one uses Racoon for establishing IPSec tunnels and the other uses Strongswan. Therefore, I need both Racoon and Strongswan installed simultaneously on my ...
3
votes
1answer
3k views

IKE Phase 1 Aggressive Mode exchange does not complete

I've configured a 3G IP Gateway of mine to connect using IKE Phase 1 Aggressive Mode with PSK to my openswan installation running on Ubuntu server 12.04. I've configured openswan as follows: /etc/...
3
votes
0answers
889 views

IPsec tunnels between Linux and Solaris

I have a Solaris machine sitting out in the ether somewhere that I would like to make part of my network via IPsec. I have this working between Solaris machines but not between Solaris and Linux. I ...
2
votes
1answer
35 views

IPSec in IPSec with strongswan

I have server connected with remote LAN1 over IPSec tunnel. Now I want to setup second tunnel to LAN2 which is connected to router in LAN1, so I need to create Ipsec tunnel inside existing ipsec ...
2
votes
1answer
142 views

How to block an IP for IPSec VPN connections?

This is my current IpTables setup: Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,...
2
votes
0answers
72 views

Libreswan Testbed in VirtualBox

I'm currently working to create a testbed in VirtualBox for two VMs with an isolated opportunistic IPSec network with LibreSwan. All services are coming up fine, but network traffic between the two ...
2
votes
1answer
975 views

AWS EC2 CentOS 7 with LibreSwan IPsec Tunnel UP (Established), No Traffic flow, cannot ping Peer encryption Domain Nodes

I have LibreSwan Setup on AWS EC2 CentOS7 instance, IPsec tunnel is established with the peer (Cisco ASA). The Tunnel is up, but I no traffic. I cannot ping the nodes at the side of the peer. Here is ...
2
votes
0answers
382 views

Restrict all non-ipsec traffic with iptables

I'm using IPSEC in tunnel mode and I need to make sure that all traffic for a certain user on this computer is restricted to the VPN connection, and if the VPN is down the packets are rejected. So ...
2
votes
0answers
945 views

MacOS native IKEv2 VPN client instead of AnyConnect?

Similar to this question from half a decade ago.. Can the native MacOS IKEv2 VPN client be used in lieu of Cisco AnyConnect client? example anyconnect profile: <AnyConnectProfile> <...
2
votes
0answers
237 views

Can't ping remote host through nat on ipsec enc0 (mtu=0)

I'm up ipsec vpn to remote host. Since the remote host accepts only one ip i'm up nat for local net on enc0. Ping from ipsec host is ok: PING 172.20.162.150 (172.20.162.150): 56 data bytes 64 bytes ...
2
votes
0answers
1k views

IPSec tranport - ESP ping packet is sent but no reply is sent

I've tried to establish connection between two hosts but I cannot get it to work. When I send a ping packet I see that ESP packet is received but no reply is sent. What can be wrong? conn core-02 ...
2
votes
0answers
1k views

Cisco ASA VPN DH Groups for AWS VPC

AWS provides a neat function in its VPC that exposes a VPN service. I've configured this, and confirmed that it functions. Our customer is using a Cisco 5500 Series ASA appliance to connect to the ...
2
votes
0answers
86 views

Dual path VPN on ASA 9.2

We have two sites that are joined by a VPN over two WAN links, one primary and one backup only. The VPN endpoints are a pair of active/standby ASA clusters at each site. Each site also has multiple ...
2
votes
1answer
470 views

Strongswan RA and Strongswan site-2-site with ASA

Task: Establish communication between remote clients (192.168.79.0/24) that are connecting to VPN server (on Ubuntu) and corporate network (10.1.2.0/24) connected to Cisco ASA. Schema: 192.168.79.0/...
2
votes
0answers
49 views

Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)

I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel. Although the outside ...
2
votes
0answers
174 views

What could cause racoonctl to show a Phase2 count higher than the number of ports racoon is listening on?

In my setup I have some EC2 instances in different regions linked by GRE tunnels, using ISAKMP via racoon. This setup is inherited, so bear with me if I fumble with terminology. Sometimes I get weird ...
2
votes
0answers
2k views

Strongswan to Cisco ASA

I have a problem with connection two nets with IPsec. On the one side is Cisco ASA 55xx on the other TP-Link router with Debian 8.3 with StrongSwan behind the NAT. The problem also that I have ...
2
votes
0answers
150 views

Dynamically enable IPSec for IP connections between many servers

For a given list of internet server (example): S001 - 45.67.89.12 S002 - 67.78.90.34 S... S999 - 98.76.65.54 I want to talk from each server to any other server to any TCP service using the public ...
2
votes
0answers
961 views

Openswan IPSec VPN on AWS tunnel established but no traffic

I am setting up a tunnel with a telco using AWS/VPC/EC2/Centos7/Libreswan and have been stuck for weeks. Appreciate any help! I have 192.168.16.73 (VPN GW, EIP 52.76.x.x) and 192.168.16.116 (...
2
votes
2answers
592 views

IPv6 IPsec between two native IPv6 networks

Assume I have two networks, A and B, on sites either side of the globe. Both have native IPv6 and are using (hypothetically) just IPv6. IPv4 no longer exists. They can both access the internet ...
2
votes
0answers
858 views

CentOS + strongswan + iOS VPN API, hal

I'm trying to setup StrongSwan on CentOS for iOS with VPN API. This API uses IKEv2 protocol. Here is my logs + configuration files. When i press connect in iOS device it's getting off in a few moments....
2
votes
0answers
551 views

Is there an extension of host to host ipsec to a many-many configuration?

Having a typical host to host transport mode ipsec configuration, conn appserver01-to-swift01 leftid=@appserver01.server.com left=10.133.176.246 leftrsasigkey=xxxxxxxxxxxxxxxxxxxxxxxx ...
2
votes
0answers
258 views

Does Windows support IPComp?

The title says it all. I've configured an IPSec IKEv2 connection between a Strongswan server and a Windows 7 workstation and I'd like to use compression if possible. The config on both sides is dead ...
2
votes
2answers
6k views

subnet-to-subnet libreswan ipsec vpn

I'm configuring a "subnet to subnet VPN" between two Centos 7 server using libreswan. Each server has two nic as showed in the following image. I would allow secure communication between the subnets ...
2
votes
1answer
994 views

Strongswan transport mode ipsec within subnet

Is there any way to configure strongswan to automatically start encryption to a given subnet rather than specific host? For example, if I know that my hosts at w.x.y.z/28 will be have the same PSK ...
2
votes
0answers
877 views

FreeBSD L2TP/IPsec not routing traffic to vpn server

I have configured a VPN server on my FreeBSD server, it all seems to be running, but the VPN traffic is not routing through to the local VPN server and I cannot figure out as to why. So my question is,...
2
votes
0answers
87 views

IPsec - strange behavior

I have set up site-to-site ipsec connection between linux(debian) and mikrotik router. The tunnel is up linux configuration: config setup interfaces=%defaultroute keep_alive=60 ...
2
votes
0answers
2k views

Creating redundant IPSec connections using OpenSwan

I have a linux (netkey) instance with openswan installed, the instance has two connection to the same IPSec peer that needs to act as redundant connections. both connections' properties are the same (...
2
votes
0answers
1k views

Is it possible to do IPSec Site to Site VPN without static & public IP on one end?

I am working on a project for my engineering degree that requires me to interface with some pre-existing equipment, so I am rather limited on my options. I'm rather new to VPN and ipsec for that ...
2
votes
0answers
2k views

Site-to-site VPN between Azure Virtual Network and a Cisco RV016

I'm attempting to configure a Cisco RV016 router to connect to an Azure Virtual Network to create a site-to-site VPN, but it's not working. I'm aware that a Cisco RV016 is not in the list of ...