Forum Discussion

mr_evil_116524's avatar
mr_evil_116524
Icon for Nimbostratus rankNimbostratus
Jun 01, 2013

Need Help : Setting up IPSEC between two big-IPs

Hello All,

 

 

I am trying to setup IPSEC between two big-IPs and I have followed the following documentation reading IPSEC with big-IP:

 

 

http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-implementations-11-1-0/10.html

 

 

But it doesnt seem to work, I cannot see anything in the racoon logs also I have trid the following commands:

 

 

racoonctl -l show-sa isakmp , racoonctl -ll show-sa internal, racoonctl -l show-sa ipsec , tmsh show net ipsec-stat DOESNT not display anything which means IPSEC is not up. I have also tried to put the logs to debug by doing the following tmsh modify net ipsec ike-daemon ikedaemon log-level debug2 still doesnt no reveal anything unsual that I can see.

 

 

Also note that I have tried IPSEC in two different mood, tunnel and transport none of them seem to work .....

 

 

Can someone please help me out with this?

 

Please let me know what you need from to me help me out with this issue .... according to the doc is really simple but it doesnt work.

 

 

Both big-ips are on 11.3 hf4 firmware.

 

 

Thanks in advance.

 

config
design

10 Replies

Sort By
  • mr_evil_116524's avatar
    mr_evil_116524
    Icon for Nimbostratus rankNimbostratus
    Jun 11, 2013
    This how is now fixed.

     

    After spending some time with f5 support we found the issue and resolved it.

     

     

    For future reference users can follow the guide http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-implementations-11-2-1/14.html to setup IPSEC tunnel either between F5s or any 3rd party hardware firewall.
    • Scottie_Cole_13's avatar
      Scottie_Cole_13
      Icon for Nimbostratus rankNimbostratus
      Nov 11, 2013
      What was the fix on this? I'm having the same problem and still working with support on it.
    • mr_evil_116524's avatar
      mr_evil_116524
      Icon for Nimbostratus rankNimbostratus
      Nov 12, 2013
      Man this was a mission to get this working, to be honest it was very simple.... now that I have what 3 different IPSEC. I take it you have created Peer list, Traffic Selector List and IPsec Policy List? Have you also created forwarding VIPs? You should have two forwarding VIPs one for IN and other for Out. DO NOTE that when you are in Traffic Selector List do no specify any port just allow all ports you will control ports at VIP level Let me explain VIPs. Say your F5 A have internal IP with 192.168.0.0/20 and F5 B have 10.10.0.0/20, you create one VIP where the source is 192.168.0.0/20 and dest is 10.10.0.0/20 and you crated another VIP where source is 10.10.0.0/20 and dest is 1192.168.0.0/20, all these VIPS will be forwarding VIPs. Allow *All Ports. and *All Protocols. (for testing of course) once you have all these in place I could suggest you try to ping from site a to site b and at the same time go to your site a F5 and run the following command tcpdump -nni 0.0 host and icmp - this will tell you what VIP it is using. Let me know how to go with this.
    • Scottie_Cole_13's avatar
      Scottie_Cole_13
      Icon for Nimbostratus rankNimbostratus
      Nov 12, 2013
      I finally got the tunnel to come up, but the traffic is still trying to route out to the internet instead of over the IPSec tunnel. Any other ideas?