We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [ipsec]

IPsec (Internet Protocol Security) is a protocol for securing IP communications by authenticating and encrypting each IP packet of a communication session.

Filter by
Sorted by
Tagged with
76
votes
7answers
117k views

OpenVPN vs. IPsec - Pros and cons, what to use?

Interestingly I have not found any good search results when searching for "OpenVPN vs IPsec". So here's my question: I need to set up a private LAN over an untrusted network. And as far as I know, ...
47
votes
16answers
124k views

64-bit Cisco VPN client (IPsec)?

Cisco VPN client (IPsec) does not support 64bit Windows. Worse, Cisco does not even plan to release a 64-bit version, instead they say that "For x64 (64-bit) Windows support, you must utilize Cisco's ...
30
votes
4answers
18k views

Is data always encrypted in IPv6 communications?

I can't seem to get a straight answer to this quesion. Wikipedia says "IPsec is an integral part of the base protocol suite in IPv6," but does that mean that ALL communications are always encrypted, ...
28
votes
2answers
48k views

strongswan vs openswan

What are the differences between OpenSwan and StrongSwan? All I found is this comparison between the outdated FreeSwan and testing version of OpenSwan - i.e. current stable of OpenSwan is 2.6 (3.0 in ...
21
votes
1answer
45k views

How to set up strongswan or openswan for pure IPSEC with iPhone client?

I'm having trouble finding concrete, up-to-date information for how to set up strongswan or openswan to be used by the iphone's VPN client. My server is behind a budget linksys NAT router. I found ...
16
votes
1answer
34k views

IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?) [closed]

Searching for IPSec and Linux one inevitably will be confronted with different solutions (see below) which all seem quite similar. The question is: where is the difference? I found these projects. ...
15
votes
1answer
11k views

With iptables, match packets arrived via IPSEC tunnel

I'm using IPSEC in a tunnel mode. How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive ...
14
votes
2answers
4k views

When would you use MPLS?

After having just spent months setting up a fairly complex VPN, I'm beginning to look at alternatives for the future. Some of my network providers use MPLS to connect to us, and I suppose it works ...
13
votes
2answers
24k views

Is it possible for L2TP VPN to do auto route configuration for client during connected?

We've setup a L2TP VPN server with this tutorial, everything works like a charm. The only issue is We don't want client to route all traffic using this VPN, only a particular subnet, e.g. 10.0.0.0/...
13
votes
3answers
13k views

IPSec for LAN traffic: Basic considerations?

This is a follow-up to my Encrypting absolutely everything... question. Important: This is not about the more usual IPSec setup, where you want to encrypt traffic between two LANs. My basic goal is ...
12
votes
2answers
82k views

Which ports for IPSEC/LT2P?

I have a firewall/router (not doing NAT). I've googled and seen conflicting answers. It seems UDP 500 is the common one. But the others are confusing. 1701, 4500. And some say I need to also ...
12
votes
3answers
18k views

ipsec verify on ubuntu Two or more interfaces found, checking IP forwarding [FAILED]

Ubuntu 14.04, Openswan U2.6.38/K3.13.0-30-generic When I run ipsec verify I get this error. Two or more interfaces found, checking IP forwarding [FAILED] I see quite a few of this same ...
12
votes
2answers
2k views

What's the protocol-level difference between IPSec and “Cisco IPSec”?

Most VPN clients distinguish between IPSec and "Cisco IPSec." For example, (Apple's) iOS treats them as essentially separate things. But I can't find any explanation of what the protocol-level ...
11
votes
5answers
11k views

Security of PPTP vs IPSec

Is PPTP or IPSEC VPN more secure than the other for 'dial in' VPN, if so, why?
11
votes
2answers
2k views

20Mbps WAN limited to 10Mbps over IPSec Tunnel

We recently upgraded a remote site from a 10/10Mbps fibre to a 20/20Mbps fibre link (it is fibre to the basement, then VDSL from the basement to the office, roughly 30 meters). There are regular large ...
10
votes
2answers
10k views

Strongswan VPN tunnel between two AWS instances won't connect

I am trying to set up a VPN tunnel using StrongSwan 5.1.2 between two Amazon AWS EC2 instances running Ubuntu 14.04.2 LTS. Prior to using StrongSwan, I used open(libre)swan on an Amazon RedHat AMI, ...
9
votes
3answers
5k views

IPSec VPN between Amazon VPC and Linux Server

I'm trying to set up an IPSec VPN connection between our corporate network and Amazon's Virtual Private Cloud, using their VPN system and a Linux server. Unfortunately, the only guide I've found ...
9
votes
2answers
7k views

L2TP/IPSec from Windows 7 to ASA 5520

I am trying to setup L2TP/IPSec on our ASA5520 to support a fringe case for one of our developers. The Windows VPN subsystem apparently stores the kerberos or NTLM cookie for the login when you use ...
8
votes
2answers
27k views

Connect to a Fortinet VPN with Ubuntu

I don't know a lot about VPNs but I'd like to connect to a Fortinet VPN with Ubuntu. I can connect on Windows using Forticlient just by entering the policy server (vpn.theserver.com) and then it asks ...
8
votes
1answer
11k views

Why are only 3 ip xfrm policies needed for a IPsec tunnel?

I have a site-to-site IPsec tunnel up and running between a strongswan (v5.2.0) instance (site A) and a RouterOS router (site B). Everything works fine, the hosts in the two private subnets setup for ...
8
votes
3answers
27k views

strongSwan IKEv2 + Windows 7 Agile VPN: What is causing Error 13801

I have an AWS instance that I want to be a VPN server. It will connect Windows 7 clients to a private network in the Amazon cloud. I have installed Ubuntu 12.04 and the strongswan-ikev2 package. ...
8
votes
2answers
17k views

Strongswan (IKEv2) connection established, but no traffic routing

I've seen this sort of question posted a few times before, but so far, none of them have solved my issue. I'm trying to set up an IKEv2 VPN on my Ubuntu Server to use with my Windows Phone using ...
8
votes
1answer
286 views

If IPSec has its own IP tunnel support why do some add LT2P to the stack?

I understand that you can use IPSec to tunnel data securely. According to the Wikipedia page and a few other sources it can also tunnel IP packets and then route them through an interface. That would ...
7
votes
7answers
11k views

Alternative Cisco VPN clients for Windows XP

I'm considering investing in a Cisco ASA5505. As Cisco's own VPN client requires a service subscription, which I am trying to do without, are there any free or low-cost ipsec VPN clients that will ...
7
votes
4answers
7k views

Wireshark and IPSec

I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point ...
7
votes
1answer
20k views

What is the difference between “Main” mode and “Quick” mode when using IPsec in Windows Server?

What is the difference between “Main” mode and “Quick” mode when using IPsec in Windows Server? When does each one come into play?
7
votes
1answer
3k views

IPSec software that can use multiple CPU cores

Can anyone recommend a good IPSec software that can use multiple CPU cores to achieve performance ~2Gbps on Linux dual-CPU quad-core E5620 Xeon setup (total 16HT cores)? I have tried OpenSwan and ...
6
votes
1answer
6k views

strongSwan IPsec server with AWS EC2 VPC VPN client

I'm trying to create a VPN tunnel between 2 AWS regions. The way I'm trying to do this is by setting up a IPsec server in Linux with strongSwan in one region, and then a VPC VPN in the other region. ...
6
votes
1answer
364 views

Bypassing an Active Directory assigned IPSEC policy

I was in the process of translating some locally defined IPSEC policies on my test systems into group policies. In the process I applied an incomplete policy which was missing the line that allows ...
6
votes
1answer
20k views

Strongswan: “received NO_PROPOSAL_CHOSEN error notify” while connecting to Cisco ASA

I am trying to connect to Cisco ASA IKEv1 VPN with StrongSwan (5.5.1-4+deb9u1) on Debian Linux with 4.9.0-5-amd64 kernel. This is kind of classical question and I'have found lot of discussions on this ...
6
votes
1answer
2k views

Simultaneous IKEv1 and IKEv2 connection support in Strongswan

I'm using Strongswan to handle IPsec connections, and need a way to support both Windows (IKEv2) and OS X (IKEv1) clients. I would prefer to use pure IPsec (i.e. avoid having to setup L2TP) unless ...
6
votes
1answer
5k views

ASA site-to-site IPSec vpn to linux ipsec-tools endpoints stops working after a random period of time

We swapped to ASA's over the weekend, and we replaced our VPN infrastructure which was previously based on openvpn and are now using IPSec between our ASA 5520's and our other sites that have linux (...
6
votes
2answers
1k views

Setting up IPSEC on LAN between two hosts (OpenBSD)

Trying to use IPSEC between two hosts on a LAN. No VPN involved Using OpenBSD 5.8 (in VirtualBox). I'd prefer to use OpenBSD's built-in support for IPSEC and key exchange and not a third-party. Two ...
6
votes
1answer
25k views

strongSwan setup where both sides are behind NAT

I'm trying to setup a strongSwan server in my home and connect to it from another network. Let's say sun is the VPN server and venus is the client. Both sun and venus are behind NAT networks. sun is ...
6
votes
1answer
17k views

Can't get past “pending Phase 2” on OpenSWAN <-> ISA Server IPSec VPN

The issue I´m having quite a hard time configuring OpenSWAN on my Linux server (Ubuntu 12.04) to connect to an ISA Server 2004 IPSec VPN. There is apparently something wrong in the configuration that ...
6
votes
1answer
1k views

Can I use Win 2k8 R2 as an IPSEC client?

I'm trying to connect a win server 2008 R2 box to a juniper ssg firewall using a client-to-gateway IPSEC VPN. I tried to set it up in Windows Firewall with Advanced Security, but the connection doesn'...
6
votes
2answers
6k views

Issue routing openswan vpn traffic beyond the server

Trying to set up a openswan based server sitting in an Amazon VPC cluster. The goal is to make it so we can VPN into VPC and have our workstations be as if they were on the network, more of a ...
5
votes
1answer
58k views

IPsec VPN site-to-site: How should I configure the ipsec.conf files on both sites to get the tunnel up?

What I am trying to do is to create a site-to-site IPsec VPN between my network and my friend's network. We both have a router and two computers on each router, with all computers running Linux. So I ...
5
votes
3answers
24k views

Simple L2TP/IPsec server not working (openswan, xl2tpd, Ubuntu, Windows)

I configured openswan and xl2tpd on an Ubuntu 12.04 server (on EC2) by following various tutorials/documentation which seem to largely say the same things, but most recently this one. However, my ...
5
votes
1answer
24k views

How to enable debug logs in OpenSwan?

I use OpenSwan IPSec tunnel on CentOS 6.7. I have added the following configuration in /etc/ipsec.secrets according to this link: http://linux.die.net/man/5/ipsec.conf config setup plutodebug=all ...
5
votes
2answers
3k views

Elastic IP address on EC2 instance interface without 1:1 NAT

I have a basic Amazon VPC set up with a public and private subnet. I have deployed a Vyatta router in the public subnet that does NAT for the private subnet. I have an elastic IP address assigned to ...
5
votes
3answers
7k views

How do I route a public IP range over an IPSEC VPN?

So, I have an established IPSec Site to Site tunnel. Site A has a SonicWall, Site B has a EdgeRouter. The first tunnel consists of Site A's NATed ips to Site B's NATed ips. Everything works as ...
5
votes
1answer
10k views

Site-to-Site IPsec vpn not sending ping across a tunnel

This is my first attempt at a site-to-site VPN. I chose to use IPec because it appeared to be the best solution for what I needed to accomplish. I've followed several different tutorials over the last ...
5
votes
2answers
719 views

Best security practice for small networks - wifi, lan,

We regularly setup small networks for clients in different locations to allow them to work on different products now the question what should be the best security practice. Currently we have a wifi ...
5
votes
2answers
3k views

TCP connection through IPSec (Linux/Strongswan) stalls after exceeding PMTU

The backups (via Bacula) of one of my servers (“A”) connected via IPSec (Strongswan on Debian testing) to a storage daemon (“B”) don't finish 95% of the times they run. What apparently happens, is: ...
5
votes
3answers
11k views

How to advertise routes to IPSec tunnels in OSPF using Cisco IOS

I have Cisco 1800 series router (running C181X-ADVIPSERVICESK9-M) with lots of IPSec tunnels. I want to add this router to OSPF and configure it to advertise routes to remote subnets accessible via ...
5
votes
1answer
1k views

Restrict access to RD Gateway based on IP

I'm trying to restrict who can access our RD Gateway based on both their group membership and IP address (so people in group A can only access the system from IP address X). The Network Policy Server ...
5
votes
0answers
455 views

How to limit bandwidth per VPN connection?

I have a StrongSwan (IKEv2) server setup and would like to limit each VPN connection to 512kb/s. After researching I came across tc in Ubuntu. I don't quite understand it and am fighting through the ...
5
votes
0answers
906 views

IPSec bandwidth between two Pfsense hosts has predictable, variable bandwidth

I have a IPSec tunnel between two Pfsense machines. Both machines are connected to a 100mbps symmetrical connection. The latency between the two routers is ~70ms. I'm using AES-GCM-128 and SHA1, both ...
5
votes
1answer
2k views

IPSec + L2TP + NAT-Traversal does not work for multiple clients behind same nat

I have recently configured a VPN server hosted in AWS EC2. Details: Centos 6.4, openswan, xl2tpd, NAT-traversal. The configuration works great for a scenario when only one user connects form a given ...