IPSec VPN terminated on a loopback i/f...?

Forum|Forum|15 years ago
February 28, 2011
4 replies
7123 views

Hello, did anyone successfully tried to terminate IPSec VPN on a loopback interface? I would like to use this scenario as it would make it possible to use a single IP from a huge IP range for terminating the IPSec VPNs without a need to split the IP range. Unfortunately either it does not work or I do not know how to set it up. BTW: In the following configuration the " port1" is primary Internet link. I tried this configuration (only relevant parts of the config are shown): ================================================================= config vpn ipsec phase1-interface edit " DC1as_CPSisp1" set interface " loopback" set proposal 3des-sha1 aes128-sha1 set remote-gw 194.213.34.173 set psksecret ENC sharedsecret next end config vpn ipsec phase2-interface edit " DC1as_CPSisp1-p2_r1" set phase1name " DC1as_CPSisp1" set proposal 3des-sha1 aes128-sha1 next end config firewall policy edit 107 set srcintf " port1" set dstintf " loopback" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " HTTPS" " SSH" " PING" " AH" " ESP" " IKE" set logtraffic enable next edit 93 set srcintf " DC1as_CPSisp1" set dstintf " port1" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " ANY" set logtraffic enable set nat enable next end ================================================================= Unfortunately it seems (see the logs below) the system tries to match this VPN to a dialup-client policy-based VPN named " Remoute_Users" which I don' t know how to alter to the route-based VPN " DC1as_CPSisp1" (defined above). Of course I am taking into an account this behaviour is caused by fact the IPSec VPN just cannot be terminated on the loopback i/f but that' s just another reason to ask if anybody has an experience with such configuration. ================================================================= 1 2011-02-28 15:30:16 log_id=0101037128 type=event subtype=ipsec pri=error vd=" root" msg=" progress IPsec phase 1" action=" negotiate" rem_ip=194.213.34.173 loc_ip=92.43.56.1 rem_port=500 loc_port=500 out_intf=" port1" cookies=" 1c931454415663ee/ee73790cb3363e5d" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" Remoute_Users" status=failure init=remote mode=main dir=inbound stage=3 role=responder result=ERROR 2 2011-02-28 15:30:16 log_id=0101037124 type=event subtype=ipsec pri=error vd=" root" msg=" IPsec phase 1 error" action=" negotiate" rem_ip=194.213.34.173 loc_ip=92.43.56.1 rem_port=500 loc_port=500 out_intf=" port1" cookies=" 1c931454415663ee/ee73790cb3363e5d" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" Remoute_Users" status=negotiate_error error_reason=probable preshared key mismatch peer_notif=NOT-APPLICABLE ================================================================= Thanks in advance for sharing Your experience Pavel Svika

rwpatterson

New Member

Welcome to the forums. When creating the IPSec tunnels, simply choose interface mode, then you can choose any valid outside interface IP to terminate the tunnel. You don' t have to go through all the gyrations you posted. Hope that helps.

psvikaAuthor

New Member

Thanks for the Welcome and for Your quick reply. Of course I know the IPSec VPNs are easily created on external i/fs. The reason I' m trying to use a loopback device lies in the fact I want to use an IP address from independent IP range (bound to our own BGP routed Autonomous System) which no real i/f uses. Actually, we have 2 ISPs - each connected with its own IP subnet. We want the partners and remote offices to be able to reach our end of IPSec VPN on a single IP address from the AS IP range which gets routed through any ISP that is currently up. I admit I have never seen such configuration neither in documentation nor here so I don' t know whether is this expected to work. That' s why I' m asking here - someone could possibly have tried this before... Pavel Svika

CBS

New Member

Hello Pavel,

We have the same situation here. Did you find the solution? We have already the Ipsec VPN tunnel up using a loopback. Phase 2 seems to be up. Unfortunately no services are going through the vpn. When we set up the wan outgoing interface on phase 1 we can successfully ping from each side.

Fiftynet

New Member

Hey CBS, you get anywhere? 11 year old thread... I'm in the same boat too, would also like to forward/terminate the IPsec through to a loopback, but it's not working, connects ok but not able to pass traffic getting "Received ESP packet with unknown SPI". I would like to do this for the same reason as the OP, plus gives the option to overlay a bit more security with firewall policies, which would be handy as it's a dial up VPN.

Sign up

Login with SSO

Login to the community

Login with SSO