VPN mechanism

[AhmedGalal]

Hi All, 

i have a question about IPsec Site to Site Tunnel ... while establishing the tunnel how is the configured source interface communicate to the destination tunnel address ??? is it through routing table or it just send traffic out of the configured interface ??????

[ede_pfau]

Interface-based (or 'route based') IPsec VPN always needs a route to the destination subnet, pointing to the local tunnel interface. The phase1 and phase2 definitions won't suffice.

If you use the VPN Wizard, it will not only gather all phase1 and phase2 information but create a static route, address objects and policies for this VPN.

[AhmedGalal]

this is not what i meant not the tunnel destination network  what i mean the destination tunnel IP the real IP that Source Tunnel connect to establish the tunnel.

[ede_pfau]

Ah, sorry, my fault.

If you mean the remote public address of the remote VPN gateway, that is found via the routing table, like any other target. So it might be found using the default route, or any more detailed route you configure.

[AhmedGalal]

are you sure that its using the routing table because am configuring a source interface shouldn't it sent the packets out of this interface directly ???

[ede_pfau]

Quite sure.

Try this: delete the default route, and watch the VPN. It will not connect. (Or I'll stand corrected.)

[rwpatterson]

ede_pfau wrote:

Quite sure.

Try this: delete the default route, and watch the VPN. It will not connect. (Or I'll stand corrected.)

If the VPN isn't configured using the default gateway, then nothing will happen... For example, you have a second non-IPSec route to another entity over a different interface and have a VPN configured down there, killing the default gateway will have no effect on this traffic. There will already be a static entry for this separate entity.

[AhmedGalal]

well i cant delete the default route  , but what you are saying mean that if you have load balancing default route you cannot create IPsec tunnel through one of the ISPs !!!

[AhmedGalal]

sure i mean over SD WAN