Questions tagged [ike]
Questions relating to Internet Key Exchange (all versions) configuration, troubleshooting and operating.
34 questions
3
votes
1
answer
164
views
Firewall Security Policy for traffic that destined to / originate from the firewall
I was trying to set up a IPsec tunnel on the firewall.
I wonder how do firewall handles the traffic that destined to / originate from the firewall ?
Since Interface Profile do not have a option to ...
- 323
0
votes
2
answers
695
views
IPsec PFS Confusion
I'm reading conflicting things about how PFS works in IPsec. Some sources say it's simply a renegotiation of the Phase 1 IKE/ISAKMP SA that ignores the original IKE/ISAKMP SA lifetime value and that ...
- 1
0
votes
1
answer
1k
views
Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes
My end of the tunnel is on an ASAv in AWS. (version 9.14)
show crypto isakmp sa
4 IKE Peer: 212.239.x.y
Type : L2L Role : responder
Rekey : no State : ...
- 223
1
vote
0
answers
301
views
Diffie-Hellman with PSK/PKI in the context of IKEv1
It seems I fail to understand few things about DH's functionality in the context of IKEv1.
A little bit of context first:
During IKE Main Phase, with the 3rd and 4th messages, the peers each exchange ...
3
votes
1
answer
495
views
Wireshark Decrypting IKEv1 Text PSK to Hex
I'm trying to debug a Cisco VPN setup as part of a Uni Lab (so please don't worry about posting of keys etc. it's just a toy setup with no internet facing connection).
I want to decrypt the IKEv1 ...
- 171
1
vote
0
answers
1k
views
IKEv2 between Cisco router and Google cloud VPN
Hey I'm trying to create a tunnel between cisco router and google cloud vpn (client site) but the connection is stuck on stage 2 (UP-IDLE), need help where the problem may lie.
Some debug that I get ...
- 11
4
votes
2
answers
2k
views
MTU/MSS Oddness?
We have an IKEv2 IPSec tunnel between two Sophos XG Firewall appliances in a corporate system for a remote site.
We don't have any specialized MSS or MTU settings other than what the IPSec tunnel ...
- 181
1
vote
1
answer
177
views
IKEv2 notification payload regarding IKE SA
I am puzzled about two paragraphs regarding a notification payload in section 3.10 of RFC7296. There you can find the following:
o Protocol ID (1 octet) - If this notification concerns an existing
...
- 161
0
votes
0
answers
152
views
How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6?
How SKEYID_a in IKEV1 phase 1 used in authentication in message 5 and 6 ?
0
votes
1
answer
1k
views
Problem with getting IKEv1 tunnel between Cisco and Palo Alto to establish a tunnel more quickly
I have a Cisco 2901 router that has an IKEv1 IPSec VPN with a Palo Alto firewall. We had a problem with our existing VPN setup where it takes a long time to get the tunnel to come back up when re-...
0
votes
1
answer
1k
views
IKEV2 between ASA and Router problem
I am trying to configure a ikev2 vpn between asa and router using tunnel interface.
I have encountered the problem of it not even establishing the connection. There is no problem in the connectivity ...
- 37
0
votes
1
answer
11k
views
IPSEC Phase 1 error
Was does the MM_NO_STATE usually mean when having errors bringing phase 1 up?
IPv4 Crypto ISAKMP SA
dst src state conn-id status
X.X.X.122 X.X.X.107 MM_NO_STATE ...
4
votes
1
answer
473
views
Does Juniper have an equivalent of 'show security pki local-certificate' for remote certificates?
On a Juniper Firewall, the command show security pki local-certificate will give all sorts of detail for a local certificate. (The sort of certificate you would use to stand up an IKE connection)
My ...
- 175
1
vote
0
answers
374
views
IKE Main Mode - Dynamic peers
So i searched for some time now, read the https://www.rfc-editor.org/rfc/rfc2409[RFC][1] and simply couldn't find an answer to why Main Mode needs static adresses.
The RFC states Aggressive Mode does ...
- 11
1
vote
0
answers
1k
views
Unable to Initiate a VPN tunnel using IKEv2 [closed]
I'm having an issue with a VPN tuunel between my Firewall (ASA 5516-X) and a third party firewall so I can't check the config in the second firewall. So I decide to debug my firewall and I realized ...
