For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

invisible's avatar
invisible
Icon for Nimbostratus rankNimbostratus
Apr 18, 2017

LTM 13.0 Unable to create IPSec with traffic domain other than 0

Two F5 LTM VE systems. upgraded to 13.0   The goal is to create IPSec Tunnel when traffic selector is at non-0 Route Domain. IPsec tunnel works(ed) with only route domain 0.   There are: 1. Tw...
application delivery
BIG-IP
big-ip ltm
ipsec
LTM
security
kkohegyi_165129's avatar
kkohegyi_165129
Icon for Nimbostratus rankNimbostratus
Dec 22, 2017

Hi,

 

The “interface” mode IPSec is working between route-domains.

 

But only one traffic-selector can be associated to IPSec channel so it is unusable if you want to use more encrypted subnets.

 

kkohegyi_165129's avatar
kkohegyi_165129
Icon for Nimbostratus rankNimbostratus
Jan 10, 2018

Hi Zeiss,

 

It is a very interesting feature but

 

If I have many ipsec interface and only one traffic-selector can be associated for every interface how can i make sure the outgoing connections ?

 

Generally the IPSEC VPN is bidirectional from connection point of view. In other words any side may initate the connection.

 

I can not define the " all triggered traffic" with one traffic-selector if i have more remote subnets.

 

OR do the packets which are forwarded based on routing table bring up the corresponsive tunnel ???

 

Thanks in advance