IPsec

• Z

  IPSEC Status Uptime - what does this mean ?
  • zMaliz

  3
  0
  Votes
  3
  Posts
  129
  Views

  Z

  Thanks for the reply. That helps.
• S

  [Solved] Windows Share not working but SMB-share on Linux Server working
  • SysErr_01

  10
  0
  Votes
  10
  Posts
  251
  Views

  S

  I changed on the Phase 2 on both ends: Local network: "Network" and not "XYZ subnet" And i disabled Hardware checksum offload. Now i am able to reach the shares at least of one of the windows 10 machines. The other Machine still has a bitdefender firewall running, that i try to turn of, to see if that also works. EDIT: I was able to turn of the Bitdefender firewall again. Voila: Shares are accessible through Tunnel. So for all Virtual Machine driven pfsense installations on Qnap: Turn of Hardware checksum offload and in IPsec tell him exactly what networks you are running. Do not trust the "XYL subnet" option.
• D

  Route inbound WAN traffic to server on remote tunneled network
  • danisrael

  17
  0
  Votes
  17
  Posts
  223
  Views

  

  what about just bring up another ipsec tunnel to the other location(s) that would need to access?
• N

  Mobile client traffic not routing through vpn for some networks
  • netgateuname

  1
  0
  Votes
  1
  Posts
  87
  Views

  No one has replied

• N

  Site to Site VPN - Cannot ping remote lan
  • nappy_d

  5
  0
  Votes
  5
  Posts
  148
  Views

  N

  DOH!! Thanks for the second pair of eyes. It was the remote network was set to address instead of network. Changed that and all is working well. :)
• E

  IPSec site-to-site between PFSense and USG rekey issue
  • eragons

  3
  0
  Votes
  3
  Posts
  183
  Views

  E

  It looks stable now. Thank you for this. About Unifi phase 2, thats everything what can I config in GUI. Here is what I found in config files over SSH: left=80.188.xxx.xxx right=80.211.xxx.xxx leftsubnet=10.20.11.0/24 rightsubnet=10.20.1.0/24 ike=aes256-sha1-modp2048! keyexchange=ikev2 reauth=no ikelifetime=28800s esp=aes256-sha1! keylife=3600s rekeymargin=540s type=tunnel compress=no authby=secret auto=route keyingtries=%forever
• M

  IPSec for mobile users not working with strongswan-nm
  • milchi

  2
  0
  Votes
  2
  Posts
  132
  Views

  M

  So, after trying a lot last weekend I finally have this working. As always, RTFM helps a lot. One problem was that I used the server cert instead of the CA cert in the client, another problem was that I somehow put in 0.0.0.0/24 instead of 0.0.0.0/0 as described in the manual. In hindsight I really don't know what I was thinking.
• N

  Routed IPSEC Question
  • nc_tech

  13
  0
  Votes
  13
  Posts
  279
  Views

  N

  My issues were related to the transport network. It seems regardless of the transport network's mask (we tested with /30) it treated it like a /24. Once we moved to using a separate full 24 for each IPSEC tunnel OSPF came right up. Thank you for all of the help, this made my life a lot easier.
• 

  Error with AWS Wizard
  • deuce

  2
  0
  Votes
  2
  Posts
  99
  Views

  

  I pushed a fix for that just now, give it a try when the update shows up That particular error was because the aliases section of the config was empty. I saw a few more similar pitfalls and fixed them all.
• B

  IPsec with Smoothwall connects but drops with traffic
  • bobmc_northernart

  1
  0
  Votes
  1
  Posts
  124
  Views

  No one has replied

• G

  ipsec tunnel with nat at 1 site
  • godfried84

  2
  0
  Votes
  2
  Posts
  138
  Views

  

  @godfried84 said in ipsec tunnel with nat at 1 site: Site A Phase 1 My Identifier: IP address: manually set to WAN IP of Router/Firewall of ISP site B Why would you set my identifier to be the IP address of the other side?
• B

  2.4.4 ipsec service doesn't start automatically
  • bruor

  2
  0
  Votes
  2
  Posts
  139
  Views

  B

  Figured out a shellcmd was hanging after update that was stopping the service from starting on it's own.
• N

  Routed IPSEC - routing internet activity from one site to another
  • ngoehring123

  15
  0
  Votes
  15
  Posts
  348
  Views

  

  It's all routed, you can setup as many static routes as you want or even using a routing protocol like OSPF or BGP. No need to specify the networks to carry in IPsec at all.
• C

  IPSec tunnel from a local group of networks to a remote group of networks possible?
  • CheeMG

  2
  0
  Votes
  2
  Posts
  213
  Views

  B

  You could also do this by supernetting the phase2 if your local/remote networks are all within a non-overlapping range. In your example you could use 192.168.4.0/22 (192.168.4.0 <-> 192.168.7.255) for your local subnet on the phase 2, and 192.168.8.0/21 (192.168.8.0 <-> 192.168.15.255) for the remote subnet on the ipsec tunnel. You would then just create firewall rules at the ipsec level to govern the /24 subnets within those networks and how they talk to each other.
• 

  Remote VPN client configuration guidance please
  vpn windows • • ServerTeam

  2
  0
  Votes
  2
  Posts
  196
  Views

  

  I am disappointed in this forum because not one suggestion was offered. Usually, community support for stuff like this is pretty good. Regardless, I figured it out myself. This thread can be considered closed.
• 

  Asynchronous Cryptography
  • RMB

  3
  0
  Votes
  3
  Posts
  185
  Views

  

  Alright, that’s clear. Thanks Jimp for the quick reponse.
• P

  IPSec MTU Issue - Only from Windows 8
  • Phonebuff

  1
  0
  Votes
  1
  Posts
  110
  Views

  No one has replied

• D

  IPSEC HA Question
  • destefano

  2
  0
  Votes
  2
  Posts
  111
  Views

  

  Yes, IPsec works fine with HA, the IPsec tunnel is bound to a CARP VIP, and whichever node holds MASTER status on the CARP VIP will carry the tunnel.
• F

  after a reboot I no longer have the road to ipsec VTI
  • fredlubrano

  5
  0
  Votes
  5
  Posts
  141
  Views

  F

  Jimp, Yes problem is resolv, after deleted route static, removing the VTI gateway and reboot. Thanks for the helps fred
• T

  Draytek modem and Netgate Ipsec problem
  • tayfun1981

  2
  0
  Votes
  2
  Posts
  98
  Views

  

  That's up to what the Draytek supports. DES has been broken for ages, it should never have been in use in a modern environment. If the Draytek supports AES-128 or better, use that. Failing that, at least use 3DES.
• S

  Atom D525 and Asynchronous Cryptography
  • serialchiller

  2
  0
  Votes
  2
  Posts
  112
  Views

  

  Possibly, yes. With a single tunnel there is a chance you'd see improvement. Beyond that it's difficult to say without testing it.
• R

  ipsec can´t connect over iOS
  • RuiMiguel

  2
  0
  Votes
  2
  Posts
  176
  Views

  A

  There is Regedit Entry to change and then you have to create the VPN Adapter over Powershell. https://wiki.strongswan.org/projects/strongswan/wiki/WindowsClients For IOS you need a mac (dependig on your setup). I try to make a whole Guide for a setup when i have time. Regards Alitai
• S

  IPSEC site to site, remote private network behind a NAT
  • smitopher09

  2
  0
  Votes
  2
  Posts
  131
  Views

  A

  Without a public ipv4 address i see no chance.
• A

  2 mobile clients tunnels supported?
  • Alitai

  3
  0
  Votes
  3
  Posts
  100
  Views

  A

  That's a clear answer. Thanks Jim! :) Then i have to wait until my provider supports ipv6 native. It should possible with 2 pfsense then. Many Thanks Have a nice evening. Regards Alitai
• A

  Phase 2 / Tunnel IPv4 / 2.4.4
  • Alitai

  2
  0
  Votes
  2
  Posts
  155
  Views

  A

  Just found out that this should not be there: Remote Network (If using a Tunnel mode): This option (only present for non-mobile tunnels) specifies the IP Address or Network that exists on the other (remote) side of the VPN. It operates similarly to the Local Network option mentioned previously. Removed everything and now the field is not longer there. Problem solved! Thanks Regards Alitai
• M

  A tip about "Network configuration for Virtual Address Pool" in IPSec Mobile Clients configuration.
  • mmangiante

  1
  0
  Votes
  1
  Posts
  89
  Views

  No one has replied

• M

  IPSEC VPN Linux Mint 19 does not work
  • mmangiante

  5
  0
  Votes
  5
  Posts
  307
  Views

  

  Makes sense. And thanks for posting your solution. Many people end up fixing their problems and don't come back to update their post to help other people in the future.
• R

  Problems with IPsec vpn between pfSense and Oracle Cloud Infrastructure
  • RodrigoCBraga

  18
  0
  Votes
  18
  Posts
  541
  Views

  E

  @derelict I agree with you, since I have configured others tunnels with different suppliers to Oracle without use that requirement, but I saw some intermittencies. Thank you, Ernani
• M

  Configure Linux Mint vpn client to use radius for authentication.
  • mmangiante

  2
  0
  Votes
  2
  Posts
  111
  Views

  M

  Finally I have resolved with the installation of various packages: network-manager-strongswan (I have to download and install the 1.4 version because the stock package, 1.3, has a bug) strongswan-plugin-eap-mschapv2 strongswan-plugin-eap-radius strongswan-starter libcharon-standard-plugins libcharon-extra-plugins libstrongswan-standard-plugins libstrongswan-extra-plugins Remember to restart the client before try the connection. Marco
• T

  IPSec VPN PFSense to PFSense 2.4.3
  • tompark

  2
  0
  Votes
  2
  Posts
  266
  Views

  P

  Try IKEv2 and another my/peer identifier than ip address. I choose a KeyID tag and created names that identified the two sites.
• M

  IPSec Site-to-Site RSA
  • michaelschefczyk

  1
  0
  Votes
  1
  Posts
  74
  Views

  No one has replied

• Z

  IPSEC VPN to Meraki Issue
  • zMaliz

  1
  0
  Votes
  1
  Posts
  72
  Views

  No one has replied

• I

  Intermittent IPSEC VPN with Fortigate
  • ivanildogalvao

  1
  0
  Votes
  1
  Posts
  102
  Views

  No one has replied

• E

  IPSec not connecting sometimes
  • emammadov

  7
  0
  Votes
  7
  Posts
  270
  Views

  E

  I don't know what is happening on the other side. I will ask the remote side network administrator. There is same configurations on both sides. What could be the problem in your opinion?
• M

  IPSec Down after Upgrade to 2.3
  • moterpent

  72
  0
  Votes
  72
  Posts
  25817
  Views

  C

  @timmzahn said in IPSec Down after Upgrade to 2.3: ou ever find a more elegant solution to the issue, or are you sti I know this topic is old, but since I found it via google I will post my solution. I did replace OpenBGP with FrrBGP. I have been able to restore my IPSEC tunneling with AWS and also use the BGP services on PfSense for my needs.
• T

  SG-3100 IPSEC tunnels do not pass traffic after creating 275 simultaneous tunnels
  • teott1

  1
  0
  Votes
  1
  Posts
  98
  Views

  No one has replied

• D

  IPSec Site to Site requires port 500 open on WAN?
  • drkrieger

  4
  0
  Votes
  4
  Posts
  180
  Views

  

  That would be information I would expect to be provided. If not, then that's OP's problem and will only delay assistance.
• C

  vici client connecting and disconnecting
  • coreybrett

  2
  0
  Votes
  2
  Posts
  966
  Views

  

  That is either Status > IPsec or the IPsec dashboard widget querying the status of the IPsec process. Yes, it's normal.
• R

  IPcomp going to be fixed in 2.4.4?
  • rcfa

  4
  0
  Votes
  4
  Posts
  218
  Views

  R

  Bummer, it does add a noticeable amount of throughput on my line, which is bandwidth limited and has a monthly data cap. Still, with the preference setting turned into a no-op, did anyone actually try if it would work? There have been substantial changes in the underlying software, that it may work, after all, in a time long ago, it used to work fine, too.
• J

  Cannot connect to IPsec VPN from iOS 10.2
  • jmbarker

  7
  0
  Votes
  7
  Posts
  1918
  Views

  H

  @roofus Actually is the best option