topic Re: Opening ipsec tunnel flow in Network Security

Opening ipsec tunnel flow

dhikra-marghli8 — Thu, 11 Jan 2024 15:21:19 GMT

Hello

i have a question

how Opening ipsec tunnel flow? and what are the steps ?

Thanks

Re: Opening ipsec tunnel flow

MHM Cisco World — Thu, 11 Jan 2024 15:47:05 GMT

I dont full get your Q

But we ping from lan to lan to make ipsec tunnel up.

MHM

Re: Opening ipsec tunnel flow

Rob Ingram — Thu, 11 Jan 2024 15:53:11 GMT

@dhikra-marghli8 to establish an IPSec VPN - if using a policy based VPN you need to generate interesting traffic from an IP address defined in the crypto ACL, this should then establish the VPN. If using a route based VPN then the tunnel should automatically be established.

Re: Opening ipsec tunnel flow

balaji.bandi — Thu, 11 Jan 2024 16:19:48 GMT

its all depends what VPN we are discussion here, you need to put more information here to address correctly

as @Rob Ingram mentioned - you need intiate the traffic for the traffic flow end to end.

adding other note, if you using ASA you can use packet tracer also i guess.

Re: Opening ipsec tunnel flow

M02@rt37 — Thu, 11 Jan 2024 16:45:33 GMT

Hello @dhikra-marghli8

@Rob Ingram summarize perfectlu.

In policy-based VPNs, the tunnel is established based on defined policies. The initiation of the VPN tunnel is triggered by interesting traffic that matches the criteria specified in the crypto ACL. This traffic is then encrypted and sent through the VPN tunnel.

On the other hand, in route-based VPNs, the tunnel is typically always up, and it's associated with specific routes rather than traffic characteristics. This means that any traffic destined for the specified remote networks will automatically be directed through the established VPN tunnel. Route-based VPNs often use tunnel interfaces and are more flexible in handling various types of traffic.

Re: Opening ipsec tunnel flow

dhikra-marghli8 — Fri, 12 Jan 2024 11:30:07 GMT

first question : route-based VPNs what's mean ?

we use route statique ou we will use routing protocols to open a flow between two networks ?? or GRE

second question :

policy-based VPNs means tunnel ipsec use policy firewall ? to open a flow ?

i wait a reply

Thanks

Re: Opening ipsec tunnel flow

M02@rt37 — Fri, 12 Jan 2024 11:48:08 GMT

@dhikra-marghli8

In a route-based VPN, the establishment of the VPN connection is based on the routing table. This means that the decision to send traffic through the VPN tunnel is made based on the destination address of the packet and the entries in the routing table.
Route-based VPNs use routes or policies to determine which traffic should be encrypted and sent through the VPN tunnel. This can involve static routes or dynamic routing protocols.
GRE can be used in conjunction with route-based VPNs to create a tunnel, but the actual routing decisions are made based on the routing table.

In a policy-based VPN, the decision to encrypt and send traffic through the VPN tunnel is based on specific policies or rules configured on the firewall.
IPsec, a commonly used protocol for VPNs, is often associated with policy-based VPNs. The policies define which traffic should be protected and how it should be protected (encryption parameters, authentication, etc.).
These policies are often tied to specific criteria such as source/destination IP addresses, protocols, or application types.

Re: Opening ipsec tunnel flow

MHM Cisco World — Fri, 12 Jan 2024 11:56:35 GMT

***Policy based vpn (using acl) have one status

Ipsec is active or not

This need as I mention before ping from lan to lan to make ipsec active

***route-based vpn

This have two status

Tunnel is up or down

Ipsec ove this tunnel is active or not

Here tunnel status depend on reachability of tunnel destination if not reachable then it down

And about ipsec

As you mention we can use static or igp to direct traffic through tunnel

If we use static and we dont use keepalive then ipsec is not active and we need ping to make it active

If we use igp then ipsec is active since the tunnel need ipsec to protect the igp packet between two end

MHM

Re: Opening ipsec tunnel flow

M02@rt37 — Fri, 12 Jan 2024 12:06:48 GMT

@dhikra-marghli8

Côté FortiGate voilà une documentation intéressante:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Route-based-VPN-can-establish-an-IPsec-tunnel-with/ta-p/246669