cisco VPN ipsec tunnel virtual interface operation detail question

Basically I am not clear about the virtual interface and physical interface interaction in the whole communication process, How TCP/IP stack, routing process, virtual interface, physical interface, IPSec fit together in a tunnel all or split-tunnel situation? it would be greatly appreciated if somebody can shed me some light on this.

VPN server CISCO VPN concentrator 3000, VPN client CISCO VPN client v4.7 on windows xp.

I noticed that once I establish a tunnel with concentrator, a virtual interface get activated and routing table get changed. For example. my physical interface ip 10.1.1.1 gateway 10.1.1.254 routing table(omit loopback and broadcast/multicast entries): network 0.0.0.0 mask 0.0.0.0 gateway 10.1.1.1.254 interface

10.1.1.1 metics 1

Once VPN tunnel established(Tunnel All traffics in this case) with VPN server IP as 192.168.1.254 virtual interface IP 192.168.1.1 gateway 192.168.1.254 routing table(omit loopback and broadcast/multicast entries): network 0.0.0.0 mask 0.0.0.0 gateway 192.168.1.254 interface

192.168.1.1 metrics 1 network 192.168.1.254 mask 255.255.255.255 gateway 10.1.1.254 interface 10.1.1.1 metrics 1

I understand that all traffic will be routed then to the virtual interface which tunnels it to vpn server.

My question here is: What will happen if we manually add a route to the routing table as following network 172.16.1.8 mask 255.255.255.255 gateway 10.1.1.254 interface

10.1.1.1 metrics 1

I tried this, the connection will not go, I am wondering where the traffic gets dropped? Is it in the VPN client computer TCP/IP stack? Or at the end of the tunnel VPN server dropped the unprotected traffic? How does the routing process work during the whole process?

Question continued, Similar scenario.

my physical interface ip 10.1.1.1 gateway 10.1.1.254 routing table(omit loopback and broadcast/multicast entries): network 0.0.0.0 mask 0.0.0.0 gateway 10.1.1.1.254 interface

10.1.1.1 metics 1

Once VPN tunnel established(split-tunnel in this example, only tunnel

192.168.2.0/24.) with VPN server IP as 192.168.1.254 virtual interface IP 192.168.1.1 gateway 192.168.1.254 routing table(omit loopback and broadcast/multicast entries): network 0.0.0.0 mask 0.0.0.0 gateway 10.1.1.1.254 interface 10.1.1.1 metics 1 network 192.168.2.0 mask 255.255.255.0 gateway 192.168.1.254 interface 192.168.1.1 metrics 1 network 192.168.1.254 mask 255.255.255.255 gateway 10.1.1.254 interface 10.1.1.1 metrics 1

All traffic destined for 192.168.2.0/24 network is routed to virtual interface thus tunnelled. All other traffic is routed to physical interface and unprotected.

My question here is: What will happen if we manually add two routes to the routing table as following

which add the following entry to the routing table: network 172.16.1.8 mask 255.255.255.255 gateway 192.168.1.254 interface

192.168.1.1 metrics 1 network 192.168.2.8 mask 255.255.255.255 gateway 10.1.1.254 interface 10.1.1.1 metric 1

I tried the similar scenario in real split-tunnel VPN connection, manually redirect the first similar situation(Redirect plain traffic to the virtual interface) will not go anywhere, is it dropped by virtual interface or VPN server? manually redirect the second similar situation(Redirect supposedly protected traffic to the physical interface) go to the destination without VPN tunnelling. How that occured? So VPN client does not mandate the protected traffic to virtual interface?

Reply to
ricecs
Loading thread data ...

The VPN server will drop protected packetes, which should be unprotected (from its knowledge) and vice versa. In order to transport packets through a tunnel, BOTH ends must know, which addresses are involved.

It works as observed.

VPN server.

The VPN client is a device driver which only works with traffic comming through the virtual interface. If you bypass this by manual configuration, the VPN clients can't notice it and therefore will not encrypt it.

Usually a VPN client is able to prevent manual routing entries anyway.

Reply to
Lutz Donnerhacke

Since I redirect the specific traffic to the physical interface bypassing the virtual interface, is the traffic still sent to VPN server via the tunnel? If it's the case, how the traffic get the destination IP address encapsulated in a ip header of VPN server?

Reply to
ricecs

No.

ESP encapsulated the whole packet including the IP addresses.

Reply to
Lutz Donnerhacke

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.