topic Re: Site 2 Site VPN in General Topics

Site 2 Site VPN

RC-BHF — Thu, 22 Jun 2017 12:41:19 GMT

I have an issue where we have ike traffic comeing from the end point which is being allowed but the ipsec-esp is being caught by the deny all rule. The strange thing is that the the rule to allow ike and ipsec-esp is on the same rule.

We do carry out NAT on the public IP for some ports , is this this the issues

Can any one please point me in the right direction

Re: Site 2 Site VPN

_slv_ — Thu, 22 Jun 2017 13:18:37 GMT

Please show us that rule. What about port/services - are You using defualt one?

Regards

Slawek

Re: Site 2 Site VPN

TranceforLife — Thu, 22 Jun 2017 13:49:51 GMT

Based on the external source IP (your remote office) temporary allow all traffic (any) and observe the behaviour. ESP has no port number so no it is not a NAT issue.

Re: Site 2 Site VPN

BPry — Thu, 22 Jun 2017 13:55:38 GMT

As @_slv_ already pointed out your rule is likely malformed so the traffic isn't getting caught. A picture of the rule would do wonders here over the logs.

Re: Site 2 Site VPN

OtakarKlier — Thu, 22 Jun 2017 14:14:30 GMT

Hello,

On my tunnels I have the following applications allowed so they are not blocked. I also whitelist the source/destination IP's for my site to site vpns for added protection:

Hope that helps.