Does anyone have 11.6 LTM doing IPsec with 3rd party device

Configuring IPsec for Tunnel Mode and Dynamic Security Negotiation link text

Configuring IPsec between a BIG-IP System and a Third-Party Devicelink text

So I followed these instructions to set up my tunnels. Two different F5 engineers have looked at it and say it should work. Tunnels come up, but no traffic flows. Do you have to create a special virtual server for the target ip range? bc

So I wasn't asking for instructions, just if anyone has actually gotten an IPsec tunnel to work with another site.

So after yeoman work by Damon at F5, we got all of the issues resolved. First, follow the instructions to get the connection working, sort of. Once we had the tunnel set up between the systems (getting the parameters right helps), we still ran into problems with TCP connections initiated from the F5 end. Now comes the weird part. We created a route to the remote network inside the tunnel and pointed it to the gateway for the network that contains the F5 endpoint. Once this route was added to the mix, all of the TCP and other connections worked. So the missing instruction is to be sure you add a route to the target remote networks to the F5 using the endpoint gateway as the next hop. This is basically the way that Cisco used to work where you put the IPsec association on the endpoint interface.

Hi,

I am also trying to establish an IPSec against Amazon AWS following the https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-implementations-11-2-0/11.html but for some reason no traffic flowtriggers the Traffic Selector to establish the Tunnel. Has anyone gotten IPsec tunnel to work?

All input is welcome.

Thanks

Diego

Sort of works. Be sure to create a route in Networks/Route to the target network and have a forwarding IP that can send the traffic down into Linux-Land to hop in the tunnel. bc

Bill, according to what you said in the comments from 1 month ago and the latest one, I should add a static route to the specific remote network using as a gateway one of the router of the default gateway pool. But if the traffic is going to te default route anyway, why adding an static route will fix the issue and will force the traffic into the tunnel?. This isn´t clear to me yet.

Thanks

So after many tries, I installed a surplus ASA 5510 and moved all of my IPsec tunnels over to it. Works like a champ, once you get it working. The F5 solution is just not reliable or repeatable for production use.