Re: IPSec Routing/Firewall Issues

Actually, don't waste your time editing the ipsec config, just add a new
configuration for each server using the UI.

Best,
James



On 28 April 2016 at 15:00, James Bewley <[email protected]> wrote:

> I've figured the multiple routes to Cisco ASA out now.
>
> It appears that the Cisco ASA treats each access-list rule as a separate
> connection and your ipsec.conf needs to have a connection for each server
> eg:
>
> config setup
>         protostack=netkey
>         klipsdebug="none"
>         plutodebug="none"
>         uniqueids=yes
>         nat_traversal=yes
>         virtual_private=%v4:
> 10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.123.0/255.255.255.0,%v4:!10.0.123.123/255.255.255.255,%v4:!10.0.123.124/255.255.255.255
>
> conn %default
>         keyingtries=0
>         disablearrivalcheck=no
>         leftupdown=/usr/local/bin/ipsecupdown.sh
>
> #
> # net-2-net to RED
> conn Site2
>         left=<public IP - site1>
>         leftsubnet=192.168.123.0/255.255.255.0
>         right=<public IP - site2>
>         ike=aes256-sha-modp1024
>         esp=aes256-sha1
>         ikelifetime=8h
>         keylife=8h
>         dpddelay=30
>         dpdtimeout=120
>         dpdaction=hold
>         pfs=no
>         authby=secret
>
> # Server 1
> conn Site2-Server1
>         also=Site2
>         rightsubnet=10.0.123.123/255.255.255.255
>         auto=start
>
> # Server 2
> conn Site2-Server2
>         also=Site2
>         rightsubnet=10.0.123.124/255.255.255.255
>         auto=start
>
> Best,
> James
>
>
>
> On 21 April 2016 at 13:53, James Bewley <[email protected]>
> wrote:
>
>> Hi,
>>
>> I am using IPSec on IPCop to route traffic to a remote network behind a
>> Cisco ASA.  It is working but there are a couple of issue I am having with
>> the finer details of routing/firewall configuration.
>>
>> Issue 1:
>>
>> I need to route to multiple remote subnets but the UI doesn't appear to
>> allow this?
>>
>>
>> Issue 2:
>>
>> Applying firewall rules to the inbound traffic from the IPSec tunnel
>> doesn't appear to work the same as other interfaces.  I would expect to add
>> route to DROP all traffic from the remote subnet destined for the GREEN
>> network.  If I do this then traffic stops in both directions because the
>> rule isn't constrained to NEW TCP sessions.
>>
>> I therefore have to add another rule for every service I expect to use on
>> the remote network and ALLOW traffic from the source port.
>>
>> Is this expected?
>>
>>
>>
>>
>> Best,
>> James
>>
>>
>
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user