IPSec VPN terminated on a loopback i/f...?

[psvika]

Hello, did anyone successfully tried to terminate IPSec VPN on a loopback interface? I would like to use this scenario as it would make it possible to use a single IP from a huge IP range for terminating the IPSec VPNs without a need to split the IP range. Unfortunately either it does not work or I do not know how to set it up. BTW: In the following configuration the " port1" is primary Internet link. I tried this configuration (only relevant parts of the config are shown): ================================================================= config vpn ipsec phase1-interface edit " DC1as_CPSisp1" set interface " loopback" set proposal 3des-sha1 aes128-sha1 set remote-gw 194.213.34.173 set psksecret ENC sharedsecret next end config vpn ipsec phase2-interface edit " DC1as_CPSisp1-p2_r1" set phase1name " DC1as_CPSisp1" set proposal 3des-sha1 aes128-sha1 next end config firewall policy edit 107 set srcintf " port1" set dstintf " loopback" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " HTTPS" " SSH" " PING" " AH" " ESP" " IKE" set logtraffic enable next edit 93 set srcintf " DC1as_CPSisp1" set dstintf " port1" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " ANY" set logtraffic enable set nat enable next end ================================================================= Unfortunately it seems (see the logs below) the system tries to match this VPN to a dialup-client policy-based VPN named " Remoute_Users" which I don' t know how to alter to the route-based VPN " DC1as_CPSisp1" (defined above). Of course I am taking into an account this behaviour is caused by fact the IPSec VPN just cannot be terminated on the loopback i/f but that' s just another reason to ask if anybody has an experience with such configuration. ================================================================= 1 2011-02-28 15:30:16 log_id=0101037128 type=event subtype=ipsec pri=error vd=" root" msg=" progress IPsec phase 1" action=" negotiate" rem_ip=194.213.34.173 loc_ip=92.43.56.1 rem_port=500 loc_port=500 out_intf=" port1" cookies=" 1c931454415663ee/ee73790cb3363e5d" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" Remoute_Users" status=failure init=remote mode=main dir=inbound stage=3 role=responder result=ERROR 2 2011-02-28 15:30:16 log_id=0101037124 type=event subtype=ipsec pri=error vd=" root" msg=" IPsec phase 1 error" action=" negotiate" rem_ip=194.213.34.173 loc_ip=92.43.56.1 rem_port=500 loc_port=500 out_intf=" port1" cookies=" 1c931454415663ee/ee73790cb3363e5d" user=" N/A" group=" N/A" xauth_user=" N/A" xauth_group=" N/A" vpn_tunnel=" Remoute_Users" status=negotiate_error error_reason=probable preshared key mismatch peer_notif=NOT-APPLICABLE ================================================================= Thanks in advance for sharing Your experience Pavel Svika

[rwpatterson]

Welcome to the forums. When creating the IPSec tunnels, simply choose interface mode, then you can choose any valid outside interface IP to terminate the tunnel. You don' t have to go through all the gyrations you posted. Hope that helps.

[psvika]

Thanks for the Welcome and for Your quick reply. Of course I know the IPSec VPNs are easily created on external i/fs. The reason I' m trying to use a loopback device lies in the fact I want to use an IP address from independent IP range (bound to our own BGP routed Autonomous System) which no real i/f uses. Actually, we have 2 ISPs - each connected with its own IP subnet. We want the partners and remote offices to be able to reach our end of IPSec VPN on a single IP address from the AS IP range which gets routed through any ISP that is currently up. I admit I have never seen such configuration neither in documentation nor here so I don' t know whether is this expected to work. That' s why I' m asking here - someone could possibly have tried this before... Pavel Svika

[CBS]

Hello Pavel,

We have the same situation here. Did you find the solution? We have already the Ipsec VPN tunnel up using a loopback. Phase 2 seems to be up. Unfortunately no services are going through the vpn. When we set up the wan outgoing interface on phase 1 we can successfully ping from each side.

[Fiftynet]

Hey CBS, you get anywhere?  11 year old thread...  I'm in the same boat too, would also like to forward/terminate the IPsec through to a loopback, but it's not working, connects ok but not able to pass traffic getting "Received ESP packet with unknown SPI". I would like to do this for the same reason as the OP, plus gives the option to overlay a bit more security with firewall policies, which would be handy as it's a dial up VPN.