Hi,
after playing around with various scenarios I was able to get BIG-IP to send ISAKMP packets towards Windows 2008 server, but I don't receive any response from it. For now let's just use Forwarding VS and not standard VS.
Here is my BIG-IP configuration:
ltm virtual /Common/Forwarding-VS-ipsec-test {
destination /Common/0.0.0.0:0
ip-forward
mask any
profiles {
/Common/fastL4 { }
}
source 0.0.0.0/0
translate-address disabled
translate-port disabled
}
net ipsec ike-peer /Common/test-win2008 {
phase1-auth-method pre-shared-key
preshared-key-encrypted $M$8L$gsMOhDjrMM/zNlnQ==
remote-address 192.168.85.112
verify-cert true
}
net ipsec ipsec-policy /Common/test-ipsec-policy {
ike-phase2-auth-algorithm sha1
ike-phase2-encrypt-algorithm 3des
ike-phase2-lifetime 480
mode tunnel
tunnel-local-address 192.168.85.171
tunnel-remote-address 192.168.85.112
}
net ipsec traffic-selector /Common/test-ipsec-traffic-selector {
destination-address 192.168.85.112/32
ipsec-policy /Common/test-ipsec-policy
source-address 0.0.0.0/0
}
And here are the setting of IP Security Policy on Windows 2008:
IP Filter = Any to Any IP address and port
Filter Action = Negotiate Security >> Methods: 3DES/SHA1
Authentication methods = Preshared key (same key as on BIG-IP)
Tunnel endpoint = 192.168.85.171
Connection type = All network connections
Assigned = Yes
Windows Firewall is OFF, IKE and IPsec services are Started.
Here is what I see on BIG-IP (and I see similar on Win2008 server):
admin@(BIG-IP)(cfg-sync Standalone)(Active)(/Common)(tmos) tcpdump -i 0.0 udp and port 500
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes
15:11:07.735241 IP 192.168.85.171.isakmp > 192.168.85.112.isakmp: isakmp: phase 1 I ident
15:11:09.555138 IP 192.168.85.171.isakmp > 192.168.85.112.isakmp: isakmp: phase 1 I ident
15:11:19.568163 IP 192.168.85.171.isakmp > 192.168.85.112.isakmp: isakmp: phase 1 I ident
15:11:29.580814 IP 192.168.85.171.isakmp > 192.168.85.112.isakmp: isakmp: phase 1 I ident
15:11:39.593264 IP 192.168.85.171.isakmp > 192.168.85.112.isakmp: isakmp: phase 1 I ident