Re: IPSec Routing/Firewall Issues

I've figured the multiple routes to Cisco ASA out now.

It appears that the Cisco ASA treats each access-list rule as a separate
connection and your ipsec.conf needs to have a connection for each server
eg:

config setup
        protostack=netkey
        klipsdebug="none"
        plutodebug="none"
        uniqueids=yes
        nat_traversal=yes
        virtual_private=%v4:
10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.123.0/255.255.255.0,%v4:!10.0.123.123/255.255.255.255,%v4:!10.0.123.124/255.255.255.255

conn %default
        keyingtries=0
        disablearrivalcheck=no
        leftupdown=/usr/local/bin/ipsecupdown.sh

#
# net-2-net to RED
conn Site2
        left=<public IP - site1>
        leftsubnet=192.168.123.0/255.255.255.0
        right=<public IP - site2>
        ike=aes256-sha-modp1024
        esp=aes256-sha1
        ikelifetime=8h
        keylife=8h
        dpddelay=30
        dpdtimeout=120
        dpdaction=hold
        pfs=no
        authby=secret

# Server 1
conn Site2-Server1
        also=Site2
        rightsubnet=10.0.123.123/255.255.255.255
        auto=start

# Server 2
conn Site2-Server2
        also=Site2
        rightsubnet=10.0.123.124/255.255.255.255
        auto=start

Best,
James



On 21 April 2016 at 13:53, James Bewley <[email protected]> wrote:

> Hi,
>
> I am using IPSec on IPCop to route traffic to a remote network behind a
> Cisco ASA.  It is working but there are a couple of issue I am having with
> the finer details of routing/firewall configuration.
>
> Issue 1:
>
> I need to route to multiple remote subnets but the UI doesn't appear to
> allow this?
>
>
> Issue 2:
>
> Applying firewall rules to the inbound traffic from the IPSec tunnel
> doesn't appear to work the same as other interfaces.  I would expect to add
> route to DROP all traffic from the remote subnet destined for the GREEN
> network.  If I do this then traffic stops in both directions because the
> rule isn't constrained to NEW TCP sessions.
>
> I therefore have to add another rule for every service I expect to use on
> the remote network and ALLOW traffic from the source port.
>
> Is this expected?
>
>
>
>
> Best,
> James
>
>
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user