Strangeness of IPsec

Hello guys,.

I just set up an IPsec Site to Site VPN on the following topology in GNS3:

IPSec.jpg

All configs are OK on both routers and ping test show that the VPN tunnel works correctly.

My question would be, why routers use policies automatic configuration of the phase 1 (with 2 on two priority routers) instead of using the default (priority 1)?

If I'm right, lower priority values have a higher precedence here.

R1 #sh crypto isakmp policy

World IKE policy
Priority protection Suite 2
encryption algorithm: AES - Advanced Encryption Standard (128-bit keys).
hash algorithm: Secure Hash Standard
authentication method: pre-shared Key
Diffie-Hellman group: #2 (1024 bits)
life expectancy: 600 seconds, no volume limit

Default protection suite
encryption algorithm: - Data Encryption STANDARD (56-bit keys).
hash algorithm: Secure Hash Standard
authentication method: Rivest-Shamir-Adleman Signature
Diffie-Hellman group: #1 (768 bits)
lifetime: 86400 seconds, no volume limit

As I said, the traffic of users use Phase2 appropriate two-way tunnels:

R1 #show crypto engine connections active

Algorithm of address State IP Interface ID encrypt decrypt
2001 Serial0/0 23.0.0.1 defined AES256 + 0 48 SHA
2002 Serial0/0 23.0.0.1 defined AES256 + SHA 49 0

You have an idea?

Thanks in advance!

The policy with the highest priority is with the number down the police. All of your configured strategies have a higher priority (and fewer) then the default policy.

Tags: Cisco Security

Similar Questions

Strange behavior of ISR G2 IPSec

Hello everyone,

I have 2911-SEC/K9 router with IOS 151 - 4.M7. I use IPSec + DMVPN. parameters are the following:

crypto ISAKMP policy 20
BA aes 256
Group 24
invalid-spi-recovery crypto ISAKMP
ISAKMP crypto keepalive 10

Crypto ipsec transform-set * value-name * esp - aes 256 esp-sha512-hmac

Profile of crypto ipsec * profile-name *.
transform-Set * value-name *.

int tunnelXXX

* dmvpn settings *.

Ipsec-tunnel protection profile * profile-name * shared

With these settings, I was able to load my string of 100 MB/s only for 15 mb/s and CPU at 99%

Some strange outputs:

#sh crypto eli
Hardware encryption: ASSETS
Number of hardware encryption engines = 1

CryptoEngine VPN details aboard: State = Active
Capacity: IPPCP, OF THE, 3DES, AES, IPv6, GDOI, FAILCLOSE, HA

IPSec-Session: 0 active, 3200 max, 0 failed

#sh crypto isakmp his count
Active safety ISAKMP: 5

#sh crypto isakmp his

IPv4 Crypto ISAKMP Security Association
DST CBC conn-State id
10.*. *. * 10.*. *. * QM_IDLE 1044 ACTIVE
10.*. *. * 10.*. *. * QM_IDLE 1045 ACTIVE

#sh flat REB

IPSEC D D 3 N/A

Could not encrypt pkts: 0
Could not decrypt pkts: 0
Could not encrypt pkt bytes: 0
Could not decrypt pkt bytes: 0
Spent encrypt pkts: 5747239
Past pkts to decrypt: 5750789
Spent encrypt pkt bytes: 2974407264
Passed to decrypt pkt bytes: 4220119968

Therefore, IPSec works, but why sh crypto eli is not show it? Why only 15 mb/s?

UPD: Same with 881-SEC/K9 and 871

#sh cry eli
Hardware encryption: ASSETS
Number of hardware encryption engines = 1

CryptoEngine VPN details aboard: State = Active
Capacity: IPPCP, OF THE, 3DES, AES, IPv6, GDOI, FAILCLOSE

IPSec-Session: 0 active, max, 100 0 failed

3945e (nodal point) shows very well:

Crypto eli HS
Hardware encryption: ASSETS
Number of hardware encryption engines = 1

CryptoEngine VPN details aboard: State = Active
Capacity: IPPCP, OF THE, 3DES, AES, IPv6, GDOI, FAILCLOSE, HA

IPSec-Session: 66 active, 6399 max, 0 failed

All devices using 151 - 4.M7

You can check my fault see the crypto ipsec his | I run to see if particular flow IPsec is handled by software/hardware/external engine. My * guess * is that sha512 is originally the IPsec flows be managed by software, which is causing the high CPU and poor performance. There are a LOT of questions that I have here, discussing the problems of performance through forums is always tricky... you can check with TAC if you want answers fast and strong.

Strange problem in IPSec Tunnel - 8.4 NAT (2)

Helloo all,.

This must be the strangest question I've seen since the year last on my ASA.

I have an ASA 5540, who runs the code of 8.4 (2) without any problem until I ran into this problem last week and I spent sleepless nights with no resolution! Then, take a deep breath and here is a brief description of my setup and the problem:

A Simple IPSEC tunnel between my 8.4 (2) ASA 5540 and a Juniper SSG 140 6.3.0r9.0 (road OS based VPN) screen

The tunnel rises without any problem but the ASA refused to encrypt the traffic but it decrypts with GLORY!

Here are a few outputs debug, see the output and a package tracer output that also has an explanation of my problem of NAT WEIRD:

my setup - (I won't get into the details of encryption tunnel as my tunnel negotiations are perfect and returns from the outset when the ASA is configured as response only)

CISCO ASA - IPSec network details

LAN - 10.2.4.0/28

REMOTE NETWORK - 192.168.171.8/32

JUNIPER SSG 140 - IPSec networks details

ID OF THE PROXY:

LAN - 192.168.171.8/32

REMOTE NETWORK - 10.2.4.0/28

Name host # sh cry counterpart his ipsec

peer address:

Tag crypto map: outside_map, seq num: 5, local addr:

outside_cryptomap_4 to access extended list ip 10.2.4.0 allow 255.255.255.240 host 192.168.171.8

local ident (addr, mask, prot, port): (10.2.4.0/255.255.255.240/0/0)

Remote ident (addr, mask, prot, port): (192.168.171.8/255.255.255.255/0/0)

current_peer:

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

#pkts decaps: 72, #pkts decrypt: 72, #pkts check: 72

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

local crypto endpt. : 0, remote Start. crypto: 0

Path mtu 1500, fresh ipsec generals 58, media, mtu 1500

current outbound SPI: 5041C19F

current inbound SPI: 0EC13558

SAS of the esp on arrival:

SPI: 0x0EC13558 (247543128)

transform: esp-3des esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 22040576, crypto-card: outside_map

calendar of his: service life remaining key (s): 3232

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0xFFFFFFFF to 0xFFFFFFFF

outgoing esp sas:

SPI: 0x5041C19F (1346486687)

transform: esp-3des esp-sha-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 22040576, crypto-card: outside_map

calendar of his: service life remaining key (s): 3232

Size IV: 8 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001

CONTEXTS for this IPSEC VPN tunnel:

# Sh asp table det vpn context host name

VPN CTX = 0x0742E6BC

By peer IP = 192.168.171.8

Pointer = 0x78C94BF8

State = upwards

Flags = BA + ESP

ITS = 0X9C28B633

SPI = 0x5041C19D

Group = 0

Pkts = 0

Pkts bad = 0

Incorrect SPI = 0

Parody = 0

Bad crypto = 0

Redial Pkt = 0

Call redial = 0

VPN = filter

VPN CTX = 0x07430D3C

By peer IP = 192.168.1.8

Pointer = 0x78F62018

State = upwards

Flags = DECR + ESP

ITS = 0X9C286E3D

SPI = 0x9B6910C5

Group = 1

Pkts = 297

Pkts bad = 0

Incorrect SPI = 0

Parody = 0

Bad crypto = 0

Redial Pkt = 0

Call redial = 0

VPN = filter

outside_cryptomap_4 to access extended list ip 10.2.4.0 allow 255.255.255.240 host 192.168.171.8

NAT (inside, outside) static source Ren - Ren - about destination static counterpart-host peer to route non-proxy-arp-search

network of the Ren - around object

subnet 10.2.4.0 255.255.255.240

network of the host object counterpart

Home 192.168.171.8

HS cry ipsec his

IKE Peer:

Type: L2L role: answering machine

Generate a new key: no State: MM_ACTIVE

output packet tracer extracted a packet transmitted by the network of 10.2.4.0/28 to 192.168.171.8 host

Phase: 7

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x7789d788, priority = 70, domain = encrypt, deny = false

Hits = 2, user_data is0x742e6bc, cs_id = 0x7ba38680, reverse, flags = 0 x 0 = 0 protocol

IP/ID=10.2.4.0 SRC, mask is 255.255.255.240, port = 0

IP/ID=192.168.171.8 DST, mask is 255.255.255.255, port = 0, dscp = 0 x 0

input_ifc = none, output_ifc = external

VPN settings corresponding to the encrytpion + encapsulation and the hits here increment only when I run a test of tracer from my host on the remote peer inside package.

A tracer complete package out for a packet of the 10.2.4.1 255.255.255.255 network to host 192.168.171.8:

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit rule

Additional information:

Direct flow from returns search rule:

ID = 0x77ebd1b0, priority = 1, domain = allowed, deny = false

hits = 3037156, user_data = 0 x 0, cs_id = 0 x 0, l3_type = 0 x 8

Mac SRC = 0000.0000.0000, mask is 0000.0000.0000

DST = 0000.0000.0000 Mac, mask is 0100.0000.0000

input_ifc = output_ifc = any to inside,

Phase: 2

Type:-ROUTE SEARCH

Subtype: entry

Result: ALLOW

Config:

Additional information:

in 192.168.171.0 255.255.255.0 outside

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x77ec1030, priority = 0, sector = inspect-ip-options, deny = true

hits = 212950, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = output_ifc = any to inside,

Phase: 4

Type:

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x7c12cb18, priority = 18, area = import-export flows, deny = false

hits = 172188, user_data = 0x78b1f438, cs_id = 0 x 0, use_real_addr, flags = 0 x 0,

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = output_ifc = any to inside,

Phase: 5

Type: NAT

Subtype:

Result: ALLOW

Config:

NAT (inside, outside) static source Ren - Ren - about destination static counterpart-host peer to route non-proxy-arp-search

Additional information:

Definition of static 10.2.4.1/2700 to 10.2.4.1/2700

Direct flow from returns search rule:

ID = 0x77e0a878, priority = 6, area = nat, deny = false

hits = 9, user_data is 0x7b7360a8, cs_id = 0 x 0, use_real_addr, flags = 0 x 0, proto

IP/ID=10.2.4.1 SRC, mask is 255.255.255.240, port = 0

IP/ID=192.168.171.8 DST, mask is 255.255.255.255, port = 0, dscp = 0 x 0

input_ifc = inside, outside = output_ifc

(it's the weird NAT problem I see. I see the number of hits is increment only when I run the packet tracer understands even I have pings (traffic) the 192.168.171.8 constant welcomes the 10.2.4.1/28)-s'il please see the package I pasted after the capture section)

Phase: 6

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0x7b8751f8, priority = 70, domain = encrypt, deny = false

hits = 3, user_data = 0x7432b74, cs_id = 0x7ba38680, reverse, flags = 0 x 0, proto

IP/ID=10.2.4.1 SRC, mask is 255.255.255.240, port = 0

IP/ID=192.168.171.8 DST, mask is 255.255.255.255, port = 0, dscp = 0 x 0

input_ifc = none, output_ifc = external

Phase: 7

Type: VPN

Subtype: ipsec-tunnel-flow

Result: ALLOW

Config:

Additional information:

Reverse flow from returns search rule:

ID = 0x78b0c280, priority = 69 = ipsec-tunnel-flow area, deny = false

hits = 154, user_data is 0x7435f94, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=192.168.171.8 SRC, mask is 255.255.255.255, port = 0

IP/ID=10.2.4.1 DST, mask is 255.255.255.240, port = 0, dscp = 0 x 0

input_ifc = out, output_ifc = any

Phase: 8

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional information:

Reverse flow from returns search rule:

ID = 0x77e7a510, priority = 0, sector = inspect-ip-options, deny = true

hits = 184556, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = out, output_ifc = any

Phase: 9

Type: CREATING STREAMS

Subtype:

Result: ALLOW

Config:

Additional information:

New workflow created with the 119880921 id, package sent to the next module

Information module for forward flow...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_tcp_normalizer

snp_fp_translate

snp_fp_adjacency

snp_fp_encrypt

snp_fp_fragment

snp_ifc_stat

Information for reverse flow...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_ipsec_tunnel_flow

snp_fp_translate

snp_fp_tcp_normalizer

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Result:

input interface: inside

entry status: to the top

entry-line-status: to the top

output interface: outside

the status of the output: to the top

output-line-status: to the top

Action: allow

Hostname # sh Cap A1

8 packets captured

1: 12:26:53.376033 192.168.10.252 > 10.2.4.1: icmp: echo request

2: 12:26:53.376597 10.2.4.1 > 192.168.10.252: icmp: echo reply

3: 12:26:56.487905 192.168.171.8 > 10.2.4.1: icmp: echo request

4: 12:27:01.489217 192.168.171.8 > 10.2.4.1: icmp: echo request

5: 12:27:03.378245 192.168.10.252 > 10.2.4.1: icmp: echo request

6: 12:27:03.378825 10.2.4.1 > 192.168.10.252: icmp: echo reply

7: 12:27:06.491597 192.168.171.8 > 10.2.4.1: icmp: echo request

8: 12:27:11.491856 192.168.171.8 > 10.2.4.1: icmp: echo request

8 packets shown

As you can see, there is no echo response packet at all because the package may not be wrapped while he was sent to.

I'm Karen with it. In addition, he is a firewall multi-tenant live production with no problems at all outside this for a Juniper ipsec tunnel!

Also, the 192.168.10.0/24 is another remote network of IPSec tunnel to this network of 10.2.4.0/28 and this IPSEC tunnel has a similar Juniper SSG 140 screen os 6.3.0r9.0 at the remote end and this woks like a charm with no problems, but the 171 is not be encrypted by the ASA at all.

If someone could help me, that would be greatt and greatly appreciated!

Thanks heaps. !

Perfect! Now you must find something else inside for tomorrow--> forecast rain again

Please kindly marks the message as answered while others may learn from it. Thank you.

ASA allows 1 only RAS VPN Client IPSEC

Hi all

I have a strange problem where an ASA 5510 configured for IPSEC - over - udp VPN RAS allows only one 1 customer vpn traffic through.

Other clients can connect successfully (obtain IP/DNS etc., auth using LDAP) but only the all connected client is first able to browse internal resources. Others show 0 decrypted packets when I check the statistics. I have confirmed that it is not a problem with the license that the ipsec default license allows customers up to 250 I believe. Does anyone had this problem in the past?

TKS,

Donavan

It is usually a problem with the translations, which intervened on the NAT/PAT device in front of these multiple machines:

http://www.ciscotaccc.com/Kaidara-Advisor/security/showcase?case=K71102938

Check the translations look correct initially on this device. There should be a translation for each VPN.

There were also a few bugs on multiple clients behind the same PAT, such as CSCse03299, but these had to do with IPSec over TCP connections.

-heather

Problem with IPSEC tunnel between Cisco PIX and Cisco ASA

Hi all!

Have a strange problem with one of our tunnel ipsec for one of our customers, we can open the tunnel of the customers of the site, but not from our site, don't understand what's wrong, if it would be a configuration problem should can we not all up the tunnel.

On our side as initiator:

Jan 14 13:53:26 172.27.1.254% PIX-7-702208: ISAKMP Phase 1 Exchange started (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-7-702210: Exchange of ISAKMP Phase 1 is complete (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% 6-PIX-602202: ISAKMP connected session (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-6-602201: Phase 1 ISAKMP Security Association created (local 1.1.1.1/500 (initiator), 2.2.2.2/500 remotely, authentication = pre-action, encryption = 3DES-CBC, hash = SHA, group = 2, life = 86400 s)

Jan 14 13:53:26 172.27.1.254% PIX-7-702209: ISAKMP Phase 2 Exchange started (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-7-702201: ISAKMP Phase 1 delete received (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:26 172.27.1.254% PIX-6-602203: ISAKMP disconnected session (local 1.1.1.1 (initiator), remote 2.2.2.2)

Jan 14 13:53:56 172.27.1.254% PIX-7-702303: sa_request, CBC (MSG key in English) = 1.1.1.1, dest = 2.2.2.2, src_proxy = 172.27.1.10/255.255.255.255/0/0 (type = 1), dest_proxy = 192.168.100.18/255.255.255.255/0/0 (type = 1), Protocol is ESP transform = lifedur hmac-sha-esp, esp-3des 28800 = s and 4608000 Ko, spi = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 4004

The site of the customer like an answering machine:

14 jan 11:58:23 172.27.1.254% PIX-7-702208: ISAKMP Phase 1 Exchange started (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% PIX-7-702210: Exchange of ISAKMP Phase 1 is complete (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% 6-PIX-602202: ISAKMP connected session (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% PIX-6-602201: Phase 1 ISAKMP Security Association created (local 1.1.1.1/500 (answering machine), distance 2.2.2.2/500, authentication = pre-action, encryption = 3DES-CBC, hash = MD5, group = 1, life = 86400 s)

14 jan 11:58:23 172.27.1.254% PIX-7-702209: ISAKMP Phase 2 Exchange started (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

14 jan 11:58:23 172.27.1.254% PIX-6-602301: its created, (his) sa_dest = 2.2.2.2, sa_prot = 50, sa_spi = 0x9de820bd (2649235645) sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 116

14 jan 11:58:23 172.27.1.254% PIX-7-702211: Exchange of ISAKMP Phase 2 is complete (local 1.1.1.1 (answering machine), 2.2.2.2 remote)

Jan 14 12:28:54 172.27.1.254% PIX-6-602302: SA deletion, (his) sa_dest = 2.2.2.2, sa_prot = 50, sa_spi = 0x9de820bd (2649235645), sa_trans = esp-3desesp-sha-hmac, sa_conn_id = 116

Kind regards

Johan

From my experience when a tunnel is launched on one side, but it is not on the other hand, that the problem is with an inconsistency of the isakmp and ipsec policies, mainly as ipsec policies change sets and corresponding address with ASA platform when a tunnel is not a statically defined encryption card he sometimes use the dynamic tag to allocate this vpn connection. To check if this is the case go ahead and make a "crypto ipsec to show his" when the tunnel is active on both sides, see on the SAA if the corresponding tunnel is the static encryption card set or if it presents the dynamic encryption card.

I advise you to go to the settings on both sides and ensure that they are both in the opposite direction.

Why no implicit route for traffic from IPSec-L2L tunnel?

In a hub-and-spoke IPSec environment, it is not difficult to implement routing by spoke to the hub.

But on the side of the hub of a tunnel, where the gateway of last resort for traffic by spoke it, it seems almost counterintuitive than the ACL instructions and even cryptographic doesn't implicitly create a route for the traffic of the station in the tunnel at the end (talk). It could always be replaced with a static if necessary.

There is probably a good reason for this, but I can't think of it. Or am I the only person who thinks it is strange... or maybe an opportunity to feature?

Hello

This feature exists and is called reverse road injection. The route is created dynamically (based on ACL Cryptography) and is only available when the SA is up.

http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t14/feature/guide/gt_rrie.html

HTH

Laurent.

ASA VPN IPSec: MTU or CFG error Question?

Hello

I have a strange problem... If I created a tunnel IPSec the ASA vs, it goes up but doesn't work if the package + / less 150 bytes... case of exceeded the size of the packets, the ASA didn't send to client IPSec; The size is related to the type of configured tunnels:

VPNclient Installer ping-f-l xxx

IPSec over TCP 152

IPSEC over UDP 123

No transportation Tunnelling 115

Debug icmp report always ping request and response but with packet sniffing on vlan outside don't see a response packet when I try with higher values than those appearing:
```
ping 'small':

    22   3.748396   x.x.x.x   192.168.y.y   ESP   ESP  (SPI=0x7106d9e3) <- ping request

    23   3.748884   192.168.y.y   x.x.x.x  ESP   ESP (SPI=0x05d0db4a) <- ping reply
ping 'big':

    27   2.981950   x.x.x.x   192.168.y.y   ESP   ESP(SPI=0x7106d9e3) <- ping request missing ping reply!
```
The problem occurs with any Protocol (TCP, UDP, ICMP) and checking the configuration with other ASA found no differences.

The SAA is a 5505 with fw 8.0 (4) and IPSec microcode CNlite-MC-IPSECm-HAND-2, 05.

Thank you

Arturo.

This is much like the following bug:

CSCsu26649 Big packages removed with enable configured ip-comp

Can you confirm that you have 'enable ip-comp' in your config vpn file? If so, that que desactiver turn off and you should be ok.

Better yet, go to 8.0 (5).

HTH

Herbert

IPsec over UDP - remote VPN access

Hello world

The VPN client user PC IPSEC over UDP option is checked under transport.

When I check the details of the phase 1 of IKE ASDM of user login, it shows only UDP 500 port not port 4500.

Means that user PC VPN ASA there that no device in question makes NAT.

What happens if we checked the same option in the client IPSEC VPN - over UDP and now, if we see the port UDP 4500 under IKE phase 1 Connection Details

This means that there is now ASA a NAT device VPN Client PC, but he allows IKE connection phase 1?

Concerning

MAhesh

Hello Manu,

I suggest to use the following commands on your ASA have a look at these ports as the test of VPN connections. The command that you use depends on your level of software as minor changes in the format of the command

View details remote vpn-sessiondb

view sessiondb-vpn remote detail filter p-ipaddress

Or

View details of ra-ikev1-ipsec-vpn-sessiondb

display the filter retail ra-ikev1-ipsec-vpn-sessiondb p-ipaddress

These will provide information on the type of VPN Client connection.

Here are a few out of different situations when connecting with the VPN Client

Dynamic PAT - no Transparent on the Client VPN tunnel
- Through the VPN connections do not work as connects via PAT without Transparent tunnel
Username: Index: 22

Public IP address 10.0.1.2 assigned IP::

Protocol: IPsec IKEv1

IKEv1:

Tunnel ID: 22.1

The UDP Src Port: 18451 UDP Dst Port: 500

IKE Neg Mode: Aggressive Auth Mode: preSharedKeys

Encryption: AES 256 hash: SHA1

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28551 seconds

Group D/H: 2

Name of the filter:

Client OS: Windows NT Client OS worm: 5.0.07.0290

IPsec:

Tunnel ID: 22.2

Local addr: 0.0.0.0/0.0.0.0/0/0

Remote addr: 10.0.1.2/255.255.255.255/0/0

Encryption: AES 256 hash: SHA1

Encapsulation: Tunnel

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28551 seconds

Idle Time Out: 30 Minutes idling left: 25 Minutes

TX Bytes: 0 Rx bytes: 0

TX pkts: Rx Pkts 0: 0

Dynamic PAT - Transparent tunnel (NAT/PAT) on the VPN Client
- Via VPN connections work as we use Tunneling Transparent when we train the dynamic VPN Client through PAT connection
Username: Index: 28

Public IP address 10.0.1.2 assigned IP::

Protocol: IKEv1 IPsecOverNatT

IKEv1:

Tunnel ID: 28.1

The UDP Src Port: 52825 UDP Dst Port: 4500

IKE Neg Mode: Aggressive Auth Mode: preSharedKeys

Encryption: AES 256 hash: SHA1

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28784 seconds

Group D/H: 2

Name of the filter:

Client OS: Windows NT Client OS worm: 5.0.07.0290

IPsecOverNatT:

Tunnel ID: 28.2

Local addr: 0.0.0.0/0.0.0.0/0/0

Remote addr: 10.0.1.2/255.255.255.255/0/0

Encryption: AES 256 hash: SHA1

Encapsulation: Tunnel

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28784 seconds

Idle Time Out: 30 Minutes idling left: 30 Minutes

TX Bytes: 360 bytes Rx: 360

TX pkts: 6 Pkts Rx: 6

Dynamics PAT, Transparent IPsec (TCP) on the Client VPN tunnel
- Via VPN connections work as we use Tunneling Transparent when we train the dynamic VPN Client through PAT connection
Username: Index: 24

Public IP address 10.0.1.2 assigned IP::

Protocol: IKEv1 IPsecOverTCP

IKEv1:

Tunnel ID: 24.1

The UDP Src Port: 20343 UDP Dst Port: 500

IKE Neg Mode: Aggressive Auth Mode: preSharedKeys

Encryption: AES 256 hash: SHA1

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28792 seconds

Group D/H: 2

Name of the filter:

Client OS: Windows NT Client OS worm: 5.0.07.0290

IPsecOverTCP:

Tunnel ID: 24,2

Local addr: 0.0.0.0/0.0.0.0/0/0

Remote addr: 10.0.1.2/255.255.255.255/0/0

Encryption: AES 256 hash: SHA1

Encapsulation: Tunnel TCP Src Port: 20343

The TCP Dst Port: 10000

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28792 seconds

Idle Time Out: 30 Minutes idling left: 30 Minutes

TX Bytes: 180 bytes Rx: 180

TX pkts: Rx 3 Pkts: 3

Static NAT - no Transparent on the Client VPN tunnel
- VPN Client connections to the LAN work because our VPN Client has a static NAT configured for its local IP address. This allows the ESP without encapsulation through the device doing the static NAT. You must allow the ESP traffic through the NAT device of management of the device VPN or configure VPN connections inspection if there is an ASA acting as the NAT device.
Username: Index: 25

Public IP address 10.0.1.2 assigned IP::

Protocol: IPsec IKEv1

IKEv1:

Tunnel ID: 25.1

The UDP Src Port: 50136 UDP Dst Port: 500

IKE Neg Mode: Aggressive Auth Mode: preSharedKeys

Encryption: AES 256 hash: SHA1

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28791 seconds

Group D/H: 2

Name of the filter:

Client OS: Windows NT Client OS worm: 5.0.07.0290

IPsec:

Tunnel ID: 25.2

Local addr: 0.0.0.0/0.0.0.0/0/0

Remote addr: 10.0.1.2/255.255.255.255/0/0

Encryption: AES 256 hash: SHA1

Encapsulation: Tunnel

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28791 seconds

Idle Time Out: 30 Minutes idling left: 30 Minutes

TX Bytes: 120 bytes Rx: 120

TX pkts: Rx 2 Pkts: 2

Static NAT - Transparent tunnel (NAT/PAT) on the VPN Client
- The VPN Client connections are functioning normally. Even if the host Staticly using a NAT VPN Client does not need UDP encapsulation it is always used if your connection of the VPN Client profile is configured to use (tab in the Transport of the client software)
Username: Index: 26

Public IP address 10.0.1.2 assigned IP::

Protocol: IKEv1 IPsecOverNatT

IKEv1:

Tunnel ID: 26.1

The UDP Src Port: 60159 UDP Dst Port: 4500

IKE Neg Mode: Aggressive Auth Mode: preSharedKeys

Encryption: AES 256 hash: SHA1

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28772 seconds

Group D/H: 2

Name of the filter:

Client OS: Windows NT Client OS worm: 5.0.07.0290

IPsecOverNatT:

Tunnel ID: 26.2

Local addr: 0.0.0.0/0.0.0.0/0/0

Remote addr: 10.0.1.2/255.255.255.255/0/0

Encryption: AES 256 hash: SHA1

Encapsulation: Tunnel

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28772 seconds

Idle Time Out: 30 Minutes idling left: 29 Minutes

TX Bytes: 1200 bytes Rx: 1200

TX pkts: Rx 20 Pkts: 20

Static NAT - Transparent tunnel on the VPN Client (IPsec, TCP)
- The VPN Client connections are functioning normally. Even if the host Staticly using a NAT VPN Client does not need TCP encapsulation it is always used if your connection of the VPN Client profile is configured to use (tab in the Transport of the client software)
Username: Index: 27

Public IP address 10.0.1.2 assigned IP::

Protocol: IKEv1 IPsecOverTCP

IKEv1:

Tunnel ID: 27.1

The UDP Src Port: 61575 UDP Dst Port: 500

IKE Neg Mode: Aggressive Auth Mode: preSharedKeys

Encryption: AES 256 hash: SHA1

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28790 seconds

Group D/H: 2

Name of the filter:

Client OS: Windows NT Client OS worm: 5.0.07.0290

IPsecOverTCP:

Tunnel ID: 27.2

Local addr: 0.0.0.0/0.0.0.0/0/0

Remote addr: 10.0.1.2/255.255.255.255/0/0

Encryption: AES 256 hash: SHA1

Encapsulation: Tunnel TCP Src Port: 61575

The TCP Dst Port: 10000

Generate a new key Int (T): 28800 seconds given to the key Left (T): 28790 seconds

Idle Time Out: 30 Minutes idling left: 30 Minutes

TX Bytes: 120 bytes Rx: 120

TX pkts: Rx 2 Pkts: 2

VPN device with a public IP address directly connected (as a customer VPN) to an ASA

Username: Index: 491

Assigned IP: 172.31.1.239 public IP address:

Protocol: IPsec IKE

IKE:

Tunnel ID: 491.1

The UDP Src Port: 500 UDP Dst Port: 500

IKE Neg Mode: Aggressive Auth Mode: preSharedKeys

Encryption: 3DES hash: SHA1

Generate a new key Int (T): 86400 seconds given to the key Left (T): 71016 seconds

Group D/H: 2

Name of the filter:

IPsec:

Tunnel ID: 491.2

Local addr: 0.0.0.0/0.0.0.0/0/0

Remote addr: 172.31.1.239/255.255.255.255/0/0

Encryption: AES128 hash: SHA1

Encapsulation: Tunnel

Generate a new key Int (T): 28800 seconds given to the key Left (T): 12123 seconds

Generate a new key Int (D): 4608000 K-bytes given to the key Left (D): 4607460 K-bytes

Idle Time Out: 0 Minutes idling left: 0 Minutes

TX Bytes: bytes 3767854 Rx: 7788633

TX pkts: 56355 Pkts Rx: 102824

Above are examples for your reference. I must also say that I am absolutely not an expert when it comes to virtual private networks in general. I had to learn two firewall/vpn basically on my own, as during my studies, we had no classes related to them (which was quite strange).

While I learned how to set up VPN and troubleshoot them I think I missed on the basic theory. I had plans to get the title Associates CCNA/CCNP certifications but at the moment everything is possible. Don't have the time for it.

I guess that you already go to the VPN security CCNP Exam?

Hope this helps and I hope that I didn't get anything wrong above

-Jouni

PIX 501 establish IPSEC connection, but no data transmission

Hi all

I had a strange problem with a cisco 501 pix connected cisco 3000 vpn concentrator remotely.

The pix is configured for the remote access session to the hub. The problem is that when I do a ping the ipsec tunnel is established and bytes will be transmittet but it's no or few bytes are received by the hub.

So I can't? t ping Lan behind the pix.

I don't know what could be the probelem. The two phases are created.

What can be the problem?

Attached to the PIX config.

Best regards

Kai

6.3 (4) version PIX

interface ethernet0 car

interface ethernet1 100full

ethernet0 nameif outside security0

nameif ethernet1 inside the security100

activate the password xxx

passwd xxx

host name

domain ciscopix.com

fixup protocol dns-length maximum 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol 2000 skinny

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names of

outside ip access list allow a whole

inside_access_in ip access list allow a whole

pager lines 24

MTU outside 1456

MTU inside 1456

IP address outside pppoe setroute

IP address inside 123.0.0.200 255.255.255.0

alarm action IP verification of information

alarm action attack IP audit

location of PDM 123.0.0.0 255.255.255.0 inside

PDM logging 100 information

history of PDM activate

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

outside access-group in external interface

inside_access_in access to the interface inside group

Timeout xlate 0:05:00

Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

Timeout, uauth 0:05:00 absolute

GANYMEDE + Protocol Ganymede + AAA-server

AAA-server GANYMEDE + 3 max-failed-attempts

AAA-server GANYMEDE + deadtime 10

RADIUS Protocol RADIUS AAA server

AAA-server RADIUS 3 max-failed-attempts

AAA-RADIUS deadtime 10 Server

AAA-server local LOCAL Protocol

Enable http server

http 123.0.0.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

SNMP-Server Community public

No trap to activate snmp Server

enable floodguard

Telnet 133.0.0.0 255.255.255.0 inside

Telnet timeout 5

SSH timeout 5

Console timeout 0

VPDN group pppoe_group request dialout pppoe

VPDN group pppoe_group localname *.

VPDN group ppp authentication pap pppoe_group

VPDN username *.

password *.

vpnclient Server 111.x.x.200

vpnclient mode network-extension-mode

vpnclient vpngroup vpn password *.

vpnclient user_name password pix *.

vpnclient enable

Terminal width 80

Cryptochecksum:xxxx

: end

you are the ping of the network behind the hub to devices behind the PIX?

You can then check if you see the data received on the end of PIX? You can check that by issueing the command

Crypto ipsec to show his

It will tell you by his how many bytes have been received / sent.

If you see bytes received and sent and they will increase after you issue a ping (usually the increase is 4 packs), you know this isn't the pix, but something as nat-traversal that blocks the return circulation.

Cisco 1841 ipsec tunnel protocol down after a minute

I have a strange problem where im manages to get a tha cisco ipsec tunnel 1841 to a RV016 linksys/cisco for about a minute and ping/encrypt the packets through the linen for about a minute before it breaks down. I tried different configuration and it all results in the tunnel for a minute then descend to come. I don't know if im hitting a bug and decide to if im doing something wrong.

any help is appreciated paul

RV016 firmware 2.0.18

Cisco 1841: C1841-ADVENTERPRISEK9-M), Version 12.4 (24) T

my config

no default isakmp crypto policy

!

crypto ISAKMP policy 1

BA 3des

md5 hash

preshared authentication

Group 2

lifetime 28800

ISAKMP crypto key address 0.0.0.0 eaton1234 0.0.0.0

!

!

Crypto ipsec transform-set esp-3des esp-sha-hmac ESSTS

transport mode

no default crypto ipsec transform-set

!

Crypto ipsec profile ipsec_profile1

Description in the location main site to site VPN tunnel

game of transformation-ESSTS

PFS group2 Set

!

!

!

!

!

!

!

Tunnel1 interface

Description of the location of the hand

IP unnumbered Serial0/0/0

source of tunnel Serial0/0/0

destination 209.213.x.x tunnel

ipv4 ipsec tunnel mode

tunnel path-mtu-discovery

protection of ipsec profile ipsec_profile1 tunnel

!

a debug output

Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 the proposal

Apr 24 16:42:07: IPSEC (validate_proposal_request): part #1 of the proposal

(Eng. msg key.) Local INCOMING = 209.213.xx.46, distance = 209.213.xx.164,.

local_proxy = 10.20.86.0/255.255.255.0/0/0 (type = 4),

remote_proxy = 10.0.0.0/255.255.255.0/0/0 (type = 4),

Protocol = ESP, transform = NONE (Tunnel),

lifedur = 0 and 0kb in

SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

Apr 24 16:42:07: mapdb Crypto: proxy_match

ADR SRC: 10.20.86.0

ADR DST: 10.0.0.0

Protocol: 0

SRC port: 0

DST port: 0

Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

Apr 24 16:42:07: mapdb Crypto: proxy_match

ADR SRC: 10.20.86.0

ADR DST: 10.0.0.0

Protocol: 0

SRC port: 0

DST port: 0

Apr 24 16:42:07: IPSEC (policy_db_add_ident): src dest 10.0.0.0, 10.20.86.0, dest_port

0

Apr 24 16:42:07: IPSEC (create_sa): its created.

(his) sa_dest = 209.213.xx.46, sa_proto = 50,.

sa_spi = 0x4CF51011 (1291128849).

sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2045

sa_lifetime(k/sec) = (4463729/3600)

Apr 24 16:42:07: IPSEC (create_sa): its created.

(his) sa_dest = 209.213.xx.164, sa_proto = 50,.

sa_spi = 0x1EB77DAF (515341743).

sa_trans = sa_conn_id of hmac-sha-esp, esp-3des = 2046

sa_lifetime(k/sec) = (4463729/3600)

Apr 24 16:42:07: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

you to

Apr 24 16:42:07: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): rec would notify of ISAKMP

Apr 24 16:42:07: IPSEC (key_engine_enable_outbound): select SA with spinnaker 515341743/50

Apr 24 16:42:07: IPSEC (update_current_outbound_sa): update peer 209.213.xx.164 curre

NT his outgoing to SPI 1EB77DAF

Apr 24 16:42:12: IPSEC (key_engine): request timer shot: count = 1,.

local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

Apr 24 16:42:12: IPSEC (sa_request):,.

(Eng. msg key.) Local OUTGOING = 209.213.xx.46, distance = 209.213.xx.164,.

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

Protocol = ESP, transform = esp-3des esp-sha-hmac (Tunnel),

lifedur = 3600 s and KB 4608000,

SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 0

Apr 24 16:42:42: IPSEC (key_engine): request timer shot: count = 2,.

local (identity) = 209.213.xx.46, distance = 209.213.xx.164,

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4)

Apr 24 16:42:42: % LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, sta changed

you all the downu

All possible debugging has been disabled

I would try to set up a VPN Interface virtual Tunnel on the IOS router base and the value of defined transformation in tunnel mode no transport.

In history, I have had several issues with VPN between a router IOS and the series RV.

Some IPSec sessions associated with tunnel stop working

Hello

Since I left an IPSec tunnel a router IOS to a Version running 3020 4.1.7.E there was a strange situation with a tunnel to a VPN Checkpoint 4.1: Tunnel get no problem but various IPSec sessions disappear with the only way to reset the being of "disconnection" (dixit the Sessions ' administer') whole tunnel can discuss again with interesting traffic. Example:

-VPN 1 with 3 Sessions IPSec 172.1.30.x, 89.170.11.x and 192.168.3.x

-Interesting traffic for each creates an IPsec session for each that can be viewed in the monitor or administer the Sessions

-Suddenly, none of the specific time intervals the sessions 89.170.11.x and 192.168.3.x IPSec disappear from the sessions administer and cannot be used until the entire VPN tunnel is reset, then traffic does what it is supposed to and show all the necessary IPSec sessions.

-It is not the case that the timeout of sessions has lost because they can be used in when it happens

All the world faced a similar situation?

I can't restrict logging to a counterpart to activate useful debugging - we have a number of LAN-to-LAN tunnels and quite a few customers. Can someone help me in this respect?

I do not give the Checkpoint but can pass on ideas to those that do, if anyone has any.

If I need to provide more information tell me what you need.

Thanks for any help you can provide.

Visit www.cisco.com/techsupport/ and select the security and vpn, check for troubleshooting for this document.

Cisco 1941 DMVPN and Ipsec

Hello

You start to replace all of our ISA Server with with DMVPN cisco routers. So far, we are happy with everything, but I ran into a problem. I've just set up one of our agencies and the DMVPN works very well, but this location also has a VPN tunnel to another branch that we have not replaced with Cisco equipment yet. The problem I have is that as soon as I associate an ipsec site-to-site VPN on the router, the DMVPN drops.

I create the Ipsec VPN:

map VPN_Crypto 1 ipsec-isakmp crypto

game of transformation-ESP-3DES-SHA

the value of aa.aa.aa.aa peer

match address 103 (where address is allow remote local IP subnet the IP subnet)

and everything works fine. As soon as I do the following:

interface GigabitEthernet0/1

card crypto VPN_Crypto

The DMVPN drops. If I can connect to and run:

interface GigabitEthernet0/1

No crypto card

The DMVPN happens immediately.

What could I do it wrong? Here is the config for the Tunnel0 DMVPN tunnel:

interface Tunnel0

bandwidth 1000

192.168.10.31 IP address 255.255.255.0

no ip redirection

IP 1400 MTU

authentication of the PNDH IP DMVPN_NW

map of PNDH IP xx.xx.xx.xx multicast

property intellectual PNDH card 192.168.10.10 xx.xx.xx.xx

PNDH id network IP-100000

property intellectual PNDH holdtime 360

property intellectual PNDH nhs 192.168.10.10

dmvpn-safe area of Member's area

IP tcp adjust-mss 1360

delay of 1000

source of tunnel GigabitEthernet0/1

multipoint gre tunnel mode

tunnel key 100000

Tunnel CiscoCP_Profile1 ipsec protection profile

If you need anything else the config for help just let me know. Our main site router, I had no problem with him being the DMVPN hub and also having a handful of Ipsec VPN set up on it well. I appreciate a lot of help, I really need to get both of these tunnels running simultaneously as soon as possible.

Yes, but I don't see anything looking for strange (well, configs generated by CCP always sound strange...).

Maybe you run into a bug. Have you tried a different IOS? Personally I wouldn't use 15.2 if I have to. You can try 15.0 (1) M8 and see if it works.

--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni

IPsec vpn and Anyconnect is denied by the ACL (unknown)

I am trying to configure IPsec VPN and I used the wizard of asdm (asdm version 8.4, ASA version 8.4). At the moment he is not in production and is in a test environment. Whenever I try to VPN in I get an error on the asdm syslog saying "TCP access denied by ACL from x.x.x.122 to outside:x.x.x.225/443. So I allowed all VPN traffic to this IP address that is currently the IP address as the external interface. My acl is as follows:

outside_in list extended access permit tcp any interface outside eq https

outside_in list extended access permit tcp any host x.x.x.225 eq https

Access-group outside_in in external interface

Yet, I still get the same exact error. The strange thing about this error is that it does not give me the specific ACL that denies access. There is no other access lists that could possibly block this traffic.

No idea what could be the cause this problem because I am confused.

So far, if you have configured following does not require an acl.
```
ciscoasa(config)#webvpn
ciscoasa(config-webvpn)#enable outside
ciscoasa(config-webvpn)#svc enable
You can post configuration here someone can have a look on that.
Thanks
Ajay
```

Help on configuring ipsec

Hello

We have 30 sites wan that we have configured for ipsec. the configuration is the same with 3des-sha-pfs2-isakmp. We met an unknown problem.after, allowing some of the Tunnels, we have discovered that the work one and the rest are disconnected. the interesting thing is that for example today I removed a single tunnel of the config and the problem was resolved temporary but there again it is the same thing. the error I get is strange, he mentions that the profile of peers is not found or the peer itself is unknown.

Can someone help me on this?

Thank you

OK, I had the problem with your configuration. You must have a different list of access for each location that is specific to that particular place. In your case, all traffic will correspond to the first instance of crypto and therefore will not work for other locations.

Why a strange alphabet does not appear when I type in an address box. Integration is slow and hesitant and numbers and letters are often repeated on their own?

I use the new Sierra, but the problem predates this.

Whenever I am typing a command or an address, a strange alphabet appears with blue letters and numbers below. The stalls, insertion and numbers and letters and then repeat on their own. I can't get out.

This problem comes and goes, no real reason for when it happens.

It happens when I type in the Web addresses, etc., and when I type the commands of the operating system.

Can you give more information on mac hardware.

You can download and run the latest version 3.0.5 of Etrecheck (etrecheck.com)

and post it here please.

VPNclient Installer	ping-f-l xxx
IPSec over TCP	152
IPSEC over UDP	123
No transportation Tunnelling	115

Strangeness of IPsec

IPSec.jpg

Similar Questions

Maybe you are looking for