The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
83 views

strongSwan routing issue with roadwarrior behind NAT

Using the following ipsec.conf configuration: conn %default ikelifetime=60m keylife=20m keyingtries=3 rekeymargin=3m keyexchange=ikev2 ...
1
vote
1answer
33 views

XFRM_SUB_POLICY config in kerne

When testing strongswan performance, we saw that the performance differed by a lot between an ubuntu server and a centos server, with everything else being the same. We noticed that the ...
0
votes
0answers
40 views

Configuring tun0 and tun1 IPSEC interfaces

I'm trying to make two IPSEC tunnel interfaces in order to make a bonding but i don't know how to start it since i can't find any tutorial showing something similar. Can anybody gives me an indication ...
1
vote
0answers
51 views

It is possible to make an IPSEC VPN Bonding?

I wanted to know if It is possible to bound two IPSEC tunnels ? I've already done a VPN bonding of SSH tunnels, but It will be better if I use IPSEC.
0
votes
0answers
37 views

IPsec, PepVPN, SpeedFusion Hot Failover and SpeedFusion Bonding (PepLink Load balancer)

I was looking for the difference between IPsec, PepVPN, SpeedFusion Hot Failover and SpeedFusion Bonding (PepLink Load balancer) but i can't find something well explained. I'll be glad if someone can ...
0
votes
1answer
51 views

ipsec.conf file with dynamic ipv6 address

I have been able to get strongswan ipsec tunnel between 2 linux machines with static ipv6 address. For example, a segment of my ipsec.conf file looks like left=2000::1 ...
10
votes
3answers
298 views

What is the IPsec bottleneck in Linux?

I am trying to compare the performance of several network security protocols between two hosts connected in Gigabit Ethernet. My goal here is to see if I can saturate my bandwidth, and if not, what ...
0
votes
0answers
66 views

Slow scp transfers over VPN from home network

I am trying to help out a friend that has been having issues with a IPSec VNP and scp. Allow me to describe the problem: When he connects to the IPSec VPN from a University, Starbucks, etc, he can ...
1
vote
0answers
68 views

Why doesn't Linux IPSec implementation support fragmentation before encryption?

I am trying to address an issue where ESP packets are getting fragmented as after adding the ESP header the MTU size is exceeded. The solution—which is what everybody does—is to do the fragmentation ...
0
votes
0answers
68 views

ipsec-tools can't encrypt packets after changing destination ip address?

I established a tunnel IPsec connection between two networks like the following scenario IPsec-tools and racoon and it works fine (see image) But in gateway1 I run a simple program that listen to ...
0
votes
0answers
84 views

xfrm and xfrm gc stats

Are there any stats related to the XFRM and XFRM garbage collector? I am unfortunately running on a ubuntu 10.04 and cannot upgrade. /proc/net/xfrm_stat is not available. I am chasing some ipsec ...
2
votes
0answers
103 views

How to set the remote host to a domain name with dynamic IP in *swan client?

I am now setting a vpn client for my university's own L2TP/IPSec VPN network, using both openswan, libreswan and strongswan (for different distros). Here is the problem: The remote site (VPN server) ...
0
votes
0answers
129 views

Openswan and Cisco ASA

i have post this same question on "Network Engineer" but iv got no answer and i delete from there so ill try here. I need this as soon as possible to solve it or at least to find out what is the ...
1
vote
0answers
149 views

Connect to IPsec VPN using OpenSwan

I'm connected to Internet with a simple ADSL router with NAT. I have a smartphone and a laptop running linux. I need to connect to a IPsec server using OpenSwan. First I tested that it is possible to ...
1
vote
0answers
105 views

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I ...
2
votes
1answer
2k views

Pluto not finding interface on a ipsec VPN

I'm trying to setup ipsec however pluto appears not to bind to a public IP and IPsec Kernel requires updating. This is what I've come up with so far: -IPSec Verify states my kernel is not supporting ...
2
votes
0answers
360 views

Restart specific racoon tunnel

I have several gif* interfaces on my FreeBSD box. They are representing tunnels, encrypted using racoon+ipsec. If, at some moment, one of the tunnels hangs up, I am forced to reset racoon this way: ...
2
votes
0answers
409 views

Is it possible to implement IPSec with failover between one pfSense firewall and Amazon VPC (no BGP)

I'm trying to create a VPN connexion between my firewall (a pfsense 2.0.1) and my Amazon Virtual Private Cloud (VPC). Amazon provides two peers endpoints to mount two IPsec tunnels on the same VPC. ...
1
vote
0answers
607 views

IPsec Tunnel mode - RoadWarriors configuration

I've the need to configure IPsec tunnel mode between a gateway with static NAT (let's say its public IP is 172.31.0.105) and a number of clients that are behind dynamic NAT. Reading through some ...
0
votes
0answers
318 views

How to set up two ipsec tunnels between 2 linux machines

conn %default left=128.247.19.210 leftcert=/home/alphaCert.der leftid="C=US, O=Test, CN=alpha.test.org" right=128.247.19.33 # IP address of Host rightid="C=US, O=Test, CN=beta.test.org" ...
1
vote
1answer
1k views

FreeBSD and StrongSwan routing issue

Good day, gentlemen. I have recently faced a problem when a device connected to the FreeBSD server via StrongSwan can't route outside its subnet. Let me explain in details: FreeBSD 10.0-RELEASE, ...
4
votes
1answer
230 views

IPsec doesn't read configuration when the tunnel is deleted

I've created a tunnel between two sites using IPsec. I've made an error in the configuration, the address of the destination was false, so I deleted this tunnel. But after deleting, ipsec tries to ...
0
votes
0answers
383 views

death_handler: Fatal signal 15 received

I have problem with my Linux when I try to shut it down. init 0 I get the following error: death_handler: Fatal signal 15 received setsockopt recvref[30]: Protocol not available The sytem will ...
1
vote
1answer
170 views

How to start ipsec on Gentoo after migrated to systemd?

My system is Gentoo 64bit, and is using systemd as the initialization system. After I migrated to systemd, I found there's not service to start ipsec. I tried to run /etc/init.d/ipsec, but it says it ...
1
vote
0answers
110 views

Kernel IPsec SA database: FIFO instead of LIFO

When processing an IP packet, the kernel looks into the security policy (SP) database to determine whether it is to be protected with IPsec. If the identifiers of the packet (e.g. IP addresses, etc.) ...
6
votes
1answer
921 views

What do I need to add a virtual IPsec adapter?

I'm trying to set up an IPsec connection manually from the console with iproute2. What I need is a virtual interface (at best, a virtual IP address could also be sufficient) that IPsec-transforms ...
0
votes
1answer
159 views

FreeBSD 8.2 setkey null encryption

Anyone got progress on setting null encryption in FreeBSD 8 ipsec? # ./setkey -c add 10.10.19.50 10.10.19.100 esp 1680464666 -m transport -E null -A hmac-md5 "authentication!!" ; The result of line ...
1
vote
0answers
152 views

Assigning an identity to an IPsec policy in Linux

Page 36 of RFC2367 (PF_KEYv2 Key Management API) states that when the kernel needs an IPsec security association for an outbound packet, but does not have one, it will ask the key management daemon ...
4
votes
1answer
1k views

How to fix this eth0 and eth1, where traffic going out via eth0 is failing?

I have two public IPs. One's connected to eth0 and one to eth1, from 2 separate routers as complete DMZ towards the LAN IP. I added this following: ip rule add from 10.0.0.108/32 table 1 # outbound ...
2
votes
0answers
579 views

Openswan ipsec hub and spoke setup is not working

I have configured Hub and Spoke using openswan ipsec. Tunnel is immediately getting UP but the problem is: Spoke1 can ping/access HUB's LAN and vice-versa (S1 -- HUB && HUB -- S1) Spoke2 can ...
1
vote
0answers
298 views

Multiple remote gateways for one ipsec phase 1 entry with pfsense

On a Sonicwall I've to replace it is possible to configure multiple remote gateways for one phase 1 ipsec entry. Can I do this on a pfsense 2.0 installation too? I haven't found a way so far and ...
1
vote
1answer
109 views

Which packages contain IPsec implementations and algorithms that use it for encryption?

Which package contains the implementation of IPsec and which package contains the implementation of encryption algorithms that IPsec uses for encryption? I need to use custom crytographic algorithms ...
1
vote
0answers
2k views

Openswan established NATed tunnel but, I can't ping remote end's lan PC

I am establishing site to site tunnel. 192.168.2.0/24===10.103.6.40<10.103.6.40>---10.103.6.1...10.103.6.29<10.103.6.29>===192.168.1.0/24; Local ip: 10.103.6.40 Local lan: ...
10
votes
4answers
7k views

Openswan connecting to multiple right subnets not working

I'm trying to use Openswan (version 2.6.37) to connect an IPsec VPN from my local network to a remote site. Everything works fine when I just want to connect to a single subnet on the remote site. ...
2
votes
1answer
155 views

what is internal 1 and internal 2 ip in freebsd , what is external 1 and external 2 ip in freebsd

# ifconfig gif0 create # ifconfig gif0 internal1 internal2 # ifconfig gif0 tunnel external1 external2 what is internal 1 and internal 2 IP? in freebsd what is external 1 and external 2 IP? in ...
1
vote
0answers
157 views

Installing IPSEC on FreeBSD

how to install IPSEC on two FreeBSD 9.0 machines to can send an encrypted packets between them , and let them read the encrypted packets .
2
votes
0answers
319 views

How to start racoon VPN IKE negotiation automatically?

I have configured racoon at two ends (with pre-shared keys) and trying to establish tunnel. But I have to initiate traffic to start IKE negotiation. Is there any alternative to establishing the ...
1
vote
0answers
692 views

Which of VPN or IPSec or xxx can I use here?

I'm renting a dedicated server which has a fixed / static IP and I'm using this server / IP for my business. I'm hosting a webapp / webappserver on it (Apache + Tomcat) and I've also set it up as a ...
2
votes
0answers
2k views

IPSec VPN Debian Squeeze Server for Mac OS X

I'm trying to get an IPSec VPN set up on my Debian home server, so that I can access my home network and browse without having my internet filtered by my college network, and so that I can perform ...
3
votes
1answer
296 views

ipsec auto --status fails in cronjob

I have a server monitoring script which, among other things, checks the state of an IPSec tunnel using ipsec auto --status It works like a charm when run from the console (as root) but as soon as I ...
2
votes
0answers
477 views

Route VPN gateway traffic via tun0 instead of normal gateway

On my Linux box, I have a tun0 interface by IPIP tunnel like: tun0 Link encap:IPIP Tunnel HWaddr inet addr:10.10.10.2 P-t-P:10.10.10.1 Mask:255.255.255.255 and I running an ...
2
votes
0answers
268 views

virtual network interface for ShrewSoft VPN Client

I use ShrewSoft VPN Client 2.1.7 under Arch Linux (i686) to connect to the company network using IPSec. It is configured by a .vpn file. How can I make it create a virtual network interface?
0
votes
2answers
4k views

Can't access internet after connecting to L2TP IPsec VPN

I have configured a L2TP VPN on Ubuntu server 11.04, and I can connect to it with a Mac client. But after connecting successfully to this L2TP VPN, my Mac cannot access the internet. To access the ...
2
votes
1answer
423 views

Fail to tunnel between two Solaris 10

I running 2 Solaris 10 box and trying to tunnel them up through Internet. 1 at the hosting site while the other sitting in my office. ifconfig ip.tun0 plumb ifconfig ip.tun0 192.168.1.207 ...
0
votes
1answer
180 views

Missing IPsec package in Solaris 10

I'm running Solaris 10 v5/08. Running svcs -a | grep ipsec returns nothing, so I have reason to believe IPsec isn't installed (or isn't showing up for some other reason). How can I make sure it is ...
2
votes
2answers
465 views

How to use a custom crypto algorithm in ipsec?

I wrote a custom algorithm using the kernel crypto API (by modifying the existing SHA1 and DES algorithms), compiled and added the .KO object to kernel. How can I use my algorithm in ipsec and other ...
1
vote
1answer
667 views

Getting “Protocol not supported” from setkey: why?

I'm trying to setup an IPsec connection between two Linux systems. I've enabled the kernel options mentioned on the IPsec Howto. I've setup a setkey script like this: #! /usr/sbin/setkey -vf add ...