25
My word, you do have your work cut out. OK; here's a sort of outline primer, because at the moment you've got the fundamentals so wrong that the details don't matter.
Before anything else, the fact that you haven't got static public addresses for each of your internet connections is a problem. IPSec doesn't easily support tunnels in such configurations [1]...
15
If you have multiple VPNs you might run into the issue that when they connect in random order, their interface IDs change. In that case the normal ROUTE -P ADD 10.0.0.0 MASK 255.255.0.0 10.0.0.1 IF 42 does not work. The next time the VPN connects it might have a different interface number.
Powershell has a cmdlet available that adds routes on VPN connection ...
7
When using a RODC you really have 2 options for DNS
A read only primary zone (yes I know that doesn't sound right, but it is) which is active directory integrated or
A standard secondary zone
Obviously having a writeable primary zone on a RODC (or in that office) is a security issue.
Assuming you have this, and you have setup cached credentials correctly ...
7
My question is if it would be possible to set up a VPN tunnel (ipsec) from the gateway in our office (Cisco RV082) to the VMWare host server so that we do not have to expose all VMs to the internet?
No. You can't install third party services like a VPN client on the hypervisor.
This is what you need:
A management IP address for ESXi itself. This can be ...
7
We have used tcpdump to examine traffic in and out of the two firewall nodes. I note in passing that tcpdump with {Open,Libre,Strong}S/WAN in a modern kernel can be a bit problematic, because on the interface out of which the encrypted traffic comes and goes one sees the plaintext traffic only when it leaves and not when it arrives.
Nevertheless, using ...
6
No, there is no way at this time to connect two Virtual Private Gateways in different regions. I'm sure it's a feature that's coming, given the VPC peering is available for VPCs in a single region.
As for "You are responsible for implementing HA solutions for all VPN endpoints (if required)", I discussed in a previous answer there are various techniques for ...
6
I spent some time working on this today, and as far as I can tell, it is not currently possible. While you can get the gateway IP addresses and pre-shared keys synced up, you don't seem to have any control over the IKE parameters for either cloud provider's gateways. AWS wants to use AES-128-CBC, and Azure wants to use AES-256, and that's all she wrote. (...
5
OpenVPN in bridging mode can do exactly this. I have used it extensively in this mode for similar purposes. To the network, it is indistinguishable from a switch that happens to have two ports in separate locations.
There is no need for special hardware. Any machine running Linux that has 2 NICs can do this. There are also some router distros, such as ...
5
Non-responsive hops in the middle of a traceroute is perfectly reasonable -- it just means that whatever's decrementing the TTL on those hops doesn't want to (or can't) send you back an error packet.
To diagnose the problem with the VPN, you'll need to do packet captures, more traceroutes and pings, and have a much better idea about the architecture and ...
5
So I've managed to figure this out after a lot of digging around, I am able to use the native Azure Site-to-Site VPN functionality with OpenSwan which runs on a linux box (Raspberry Pi/Arch Linux) behind my home network's NAT router.
Network topology:
192.168.0.0/24 - Home network
192.168.1.0/24 - Azure network
192.168.0.1 - Home router's private IP
192....
5
Please have a look at the following:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices
According to the documentation, assuming all of your network information is correct, you should disable Perfect Forward Secrecy if you are using static routing.
4
Sounds like you need a basic primer on how IP routing works.
Yes, each branch should be on its own subnet. Without that, you'd have L2 broadcast domains spanning your WAN which could get, well, interesting.
Do the IP phones all connect back to a central softswitch at Branch 1? If so, as long as your routing is set up correctly (either static or dynamic ...
4
Promote a DC in Site B, create two sites in AD, then assign each domain controller to its appropriate site. Also, install DNS on this server, and use it as the primary for all hosts in Site B.
Ideally, the hosts in site A would use the local DNS server as primary and the DNS server at the opposite site as secondary. Vice-versa for hosts in Site B.
4
You only get one policy active at a time but you can create many filters under the policy. See Creating and Using IPsec Policies
4
Encryption domain refers to the range of IP addresses of the hosts which will be participating in the encrypted VPN.
4
You can do this one of two ways.
The way that I would recommend is as follows:
Create a DFS namespace for your shares, something like \\domain\users should do.
Add both servers to this DFS root.
Check the box so that clients prefer (or are required) to use a server located in their AD site. Yes, it's smart enough to determine this using subnets defined in ...
4
If the clients are mapped directly to the server in question, then they should be able to enumerate new files immediately. Are you sure that you're not using some form of replication like DFS-R to push these files to servers at each remote site?
4
2.1 can do a gateway group on IPsec. Earlier versions require manual intervention for tunnel mode IPsec. Transport mode + a tunnel + a routing protocol, or more easily OpenVPN+a routing protocol, can accommodate that in all 2.x versions.
4
Iain,
What you are referring to is pretty common...you have overlapping internal subnets that won't pass traffic properly if setup on a normal IPSEC VPN tunnel (site to site).
The idea is to do a Policy NAT for the VPN traffic to change your 10.1.0.0/16 to 192.168.50.0/24 if it is tunneling over the VPN.
Cisco has a great writeup on how to do this: LAN-to-...
4
Nope, that's not what happened. Assuming you're talking about AD Integrated zones, DNS records are objects in AD. Objects have a USN which is essentially a number that increments whenever a change to that object is made. If your tunnel "blipped" the USN would be incremented on your on-prem DCs and not on your Azure-hosted DC. This means that when it came ...
4
To me it sounds like you are trying to get the site-to-site tunnel gateways to communicate via their internal IP addresses instead of their public IP addresses. In order to do this using a single tunnel you need to configure the left and right internal source addresses. See below...
leftsourceip=10.248.248.64
rightsourceip=10.131.250.194
Add those lines ...
4
Yes, UDP over a VPN is possible, but no, that wouldn't change a thing. Although the underlying transport may be reliable, the UDP has been designed not to retransmit lost packets. If you really have a problem with packetloss, either switch to TCP for transport, fix it by making the application send UDP packets slower, or increase the bandwidth on the path (...
4
It depends.
As you already know, if the site-to-site VPN drops your office computers will not be able to reach your domain controller: that will mean not only authentication issues, but that almost nothing will work correctly (think DNS, group policies, file/print sharing, etc.). A local domain controller would be a good thing to have, even if your VPN ...
3
netsh interface ipv4 add route [destination/prefixlength] "[interface/connection name]"
I'm using that to deal with connections that have subnet overlap by adding static routes for hosts on the remote subnet - servers and the like.
3
You have two options:
Change the moved server's IP address. This is really the preferred option, and there's no reason that I can see in this topology to not do this, other than to avoid making configuration changes.
Extend the subnet/broadcast domain to the remote network via L2TP.
3
Your VPN connection uses MPPE encryption, but according to router's page http://www.draytek.co.uk/products/vigor2830.html - MPPE have no hardware support.
Try to setup something else as encryption protocol (AES/DES/3DES).
IMHO it is available only with L2TP protocol.
3
Yeah, that should work just fine for you. We have a similar set up (only 3 locations though, not 6) and it works great. One thing I will advise, however, is using different subnets. Either go a little higher up than 192.168.1.x or use a 10.x.x.x or 172.168.x.x. I say this because if you ever intend to allow users VPN access from home, it's almost always that ...
3
You can do an SSH tunnel as @David suggests, though keeping the tunnel up persistently is going to require some type of process on the machine terminating the tunnel to periodically check the tunnel state and re-establish it (if necessary).
I'd probably install OpenVPN on both machines with the "host A" machine configured as a server and the "host B" ...
3
Amazon VPC doesn't currently provide a method to connect multiple VPC's - you haven't missed anything there.
If you decide to go the VPN route there are a couple of articles regarding setting this up between VPCs - one utilizes IPsec and the other OpenVPN.
I would actually recommend using SSH tunnels with port redirection from your app servers to the ...
3
No connectivity whatsoever. Imagine the security disaster that the world would be if anyone could set up a site-to-site VPN by configuring only the device on their end.
Assuming that the rest of the configuration is correct and complete, you have a tunnel between SiteA and SiteB.
They are not two totally separate site-to-site VPN configurations. Each device ...
Only top voted, non community-wiki answers of a minimum length are eligible
Related Tags
site-to-site-vpn × 372vpn × 161
ipsec × 71
azure × 47
cisco-asa × 43
cisco × 41
routing × 35
openvpn × 27
networking × 23
sonicwall × 23
amazon-web-services × 19
cisco-vpn × 18
windows-server-2008 × 16
active-directory × 16
pfsense × 16
amazon-vpc × 16
windows × 15
openswan × 15
windows-server-2008-r2 × 13
nat × 13
google-cloud-platform × 12firewall × 10
strongswan × 9
azure-networking × 9
router × 8
