IPsec

• 

  Scaling IPsec (and VPNs in general)
  • jimp  

  2
  8
  Votes
  2
  Posts
  305
  Views

  J

  Thank you!
• 

  Configuring my first pfSense to Cisco ASA IPSEC L2L connection
  • bingo600  

  1
  0
  Votes
  1
  Posts
  9
  Views

  No one has replied

• C

  Dropped ipsec / fragmented UDP packets
  • creiss  

  1
  0
  Votes
  1
  Posts
  9
  Views

  No one has replied

• M

  Is there a way to bypass CRL caching?
  • Macormick  

  1
  0
  Votes
  1
  Posts
  8
  Views

  No one has replied

• M

  Windows 10 Client, peer to aggressive
  • Macormick  

  2
  0
  Votes
  2
  Posts
  22
  Views

  M

  I have been testing DH group 19 and 20, but that resulted in "Peer to aggressive". Offcourse I had the same settings on both phase 1 and phase 2 and in Windows 10 and pfSense IKEv2 Mutual RSA config. Changed to DH Group 14, and that worked. What can be the reason?
• G

  Numerous duplicate SA entries
  • gparthasarathy  

  1
  0
  Votes
  1
  Posts
  11
  Views

  No one has replied

• A

  Multiple IPSec Mobile Clients
  • adeparker  

  2
  0
  Votes
  2
  Posts
  20
  Views

  

  That wouldn't ever work with L2TP/IPsec as the IPsec portion of L2TP/IPsec requires transport mode which only works with unique remote addresses. If you use a regular IKEv2 (e.g. EAP-MSCHAPv2) setup it should work fine. Or if you have multiple users at the same remote site that need to connect, consider a site-to-site VPN instead of relying on mobile connections.
• Y

  Outbound NAT is breaking Routed IPsec
  nat ipsec ipsec routing n ipsec rules outbound nat • • yis  

  1
  0
  Votes
  1
  Posts
  12
  Views

  No one has replied

• G

  Pushing DNS to MacOS
  • garywaynesmith  

  1
  0
  Votes
  1
  Posts
  11
  Views

  No one has replied

• S

  Windows IPSec client not getting/using DNS
  • seanmcb  

  2
  0
  Votes
  2
  Posts
  23
  Views

  S

  So in case it helps anyone landing here, I found a solution in these: http://superuser.com/questions/966832/windows-10-dns-resolution-via-vpn-connection-not-working https://answers.microsoft.com/en-us/windows/forum/windows_10-networking-winpc/win-10-dns-resolution-of-remote-network-via-vpn/513bdeea-0d18-462e-9ec3-a41129eec736?page=4
• D

  IPsec tunnel setup, cannot ping all subnets
  • davige101  

  2
  0
  Votes
  2
  Posts
  11
  Views

  D

  I finally resolved this. I had to create a LAN Gateway on Site A side because I have two LAN subnets on this, 192.168.211.x/24 and 10.0.0.x/28. I was only concerned with the 10. subnet, so I created gateway for it only as probably traffic was trying to pass over the other LAN segment, not sure. (I am not great this stuff...) Then on the Site B router, I had to add a manual NAT for its LAN network to allow the 10.0.0.0/28 traffic over it. Now I can successfully reach all endpoints for both networks. Man, that was ALOT of work. Now I get why those crappy Cisco RV routers are so popular, as it seems it creates the NAT and routes for you. davige101
• V

  Handling DNS resolution when IPsec is down
  • vegbrasil  

  1
  0
  Votes
  1
  Posts
  14
  Views

  No one has replied

• R

  ipsec vti routing can only get to firewall, no clients
  • realityman_  

  17
  0
  Votes
  17
  Posts
  45
  Views

  T

  @realityman_ my opinion this is not pfSense... maybe do you have some dynamic firewall on the host the ban your IP?
• B

  IPSec Tunnel stops working if I try to SSH to the other Firewall
  • BEVietnam  

  1
  0
  Votes
  1
  Posts
  10
  Views

  No one has replied

• M

  Is "Mutual RSA" to be considered safe?
  • Macormick  

  4
  0
  Votes
  4
  Posts
  18
  Views

  M

  @jimp Thank you!
• C

  IPSec VTI intermittently stops passing traffic
  • cemyl95  

  5
  0
  Votes
  5
  Posts
  28
  Views

  C

  @marcquark Thanks! It'll probably be a day or two before I can get over to the far side to try this but I'll let you know how it goes.
• T

  IPSec on Virtual IP fails auth
  • tiagoespinha  

  1
  0
  Votes
  1
  Posts
  10
  Views

  No one has replied

• F

  IPSec tunnel and VoIP
  • froussy  

  3
  0
  Votes
  3
  Posts
  36
  Views

  T

  @froussy I have this kind of problem when PHP is eating all CPU on my pfSense (check my post). Is your CPU load ok when you have problems?
• T

  Mobile IPSec + Routed Site to Site
  • trs_91  

  2
  1
  Votes
  2
  Posts
  20
  Views

  C

  @trs_91 I've been running into the same issue. I haven't had time to troubleshoot it really (my workaround is to RDP into a local server then jump over the site to site from there) but I'm interested to see where this thread goes.
• 1

  IPSEC pfSense to pfSense with one behind another pfSense
  • 112fan  

  1
  0
  Votes
  1
  Posts
  6
  Views

  No one has replied

• 

  IPSEC tunnel to 0.0.0.0/0 problem
  • awebster  

  1
  0
  Votes
  1
  Posts
  11
  Views

  No one has replied

• S

  ping failed
  • sasa1  

  2
  0
  Votes
  2
  Posts
  18
  Views

  S

  Hi, do you need any other information ? Thanks.
• W

  IPsec: CREATE_CHILD_SA request failed
  • Wortlaut  

  1
  0
  Votes
  1
  Posts
  13
  Views

  No one has replied

• T

  Timeout saving IPSECs
  • Topogigio  

  4
  0
  Votes
  4
  Posts
  19
  Views

  T

  I restarted the unit. The GUI reports "configuring IPSEC VPN.." and it took a lot of MINUTES to complete it... Connected via SSH during boot I see php-fm + php-cgi working a lot
• K

  ipse/ikev2 not working with iPhone or mac
  • kramtw  

  1
  0
  Votes
  1
  Posts
  16
  Views

  No one has replied

• G

  How to nat OPT interface to WAN and get it through tunnel?
  • goorooj  

  1
  0
  Votes
  1
  Posts
  11
  Views

  No one has replied

• G

  Can i use only 2 Phase2 per phase1 on pfsense?
  • goorooj  

  5
  0
  Votes
  5
  Posts
  16
  Views

  G

  I set the Ike to V2 now. There is no traffic yet. i have to check if this is running before i can proceed fight with the firewall and the routing i think.... but the child SAs tell me always the first 2 available connections that are enabled. and no matter which one. this time it shows only one, maybe the 2nd server on the other side is switched off i cleand the ip address out because its a public IP con1000: #236 192.168.33.61/32 Local: cd989838 Remote: 60c4ba15 xxx.xxx.xxx.xxx/32 Rekey: 2542 seconds (00:42:22) Life: 3472 seconds (00:57:52) Install: 128 seconds (00:02:08) AES_CBC HMAC_SHA1_96 IPComp: none Bytes-In: 0 (0 B) Packets-In: 0 Bytes-Out: 0 (0 B) Packets-Out: 0 when i disable this first two entries it shows me ( again i cleaned addresses out for being public, this time all ) con1000: #238 xxx.xxx.xxx.xxx/32 Local: c144a229 Remote: 549b87ca xxx.xxx.xxx.xxx/32 xxx.xxx.xxx.xxx/32 Rekey: 2892 seconds (00:48:12) Life: 3595 seconds (00:59:55) Install: 5 seconds (00:00:05) AES_CBC HMAC_SHA1_96 IPComp: none Bytes-In: 0 (0 B) Packets-In: 0 Bytes-Out: 0 (0 B) Packets-Out: 0 of course the remote addresses are different ones from the one before
• M

  Cisco VXR to Pfsense GRE Tunnel
  • mudvayne15  

  2
  0
  Votes
  2
  Posts
  12
  Views

  M

  Pfsense settings Internet Protocol: IPv4 Interface: WAN Authentication method: Mutual PSK Negotiation mode: Main My identifier: x.x133.66 Peer identifier: x.x96.242 Pre-Shared Key: Policy Generation: Default Proposal Checking: Default Encryption algorithm :AES 256bits Hash algorithm: SHA DH key group: 5 Lifetime: 28800 NAT Traversal: Disable Dead Peer Detection Enable: 10 seconds, 5 retries
• G

  IPSEC Problem 0.0.0.18/32 address
  • goorooj  

  1
  0
  Votes
  1
  Posts
  10
  Views

  No one has replied

• R

  IKEv2 - Phase 1 - 'Pre-Shared Key' field not available/visible
  • rhansen  

  2
  0
  Votes
  2
  Posts
  13
  Views

  

  You appear to be editing a mobile IPsec tunnel. That's not the same as what you're reading in the docs. For site-to-site tunnels, yes, Mutual PSK will show that field and button. For mobile IPsec, each user has their own key, so you add them on the Pre-Shared Keys tab.
• 

  Hello. I need to access a remote IPSec Phase 2 network from VLAN interface using routing
  • gribfk  

  8
  0
  Votes
  8
  Posts
  20
  Views

  K

  @gribfk 1 show the phase-2 settings 2 show the output of the command ipsec statusall after the IPSEC connection is established 3 show the firewall rules on the VLAN10 interface 4 show the output of the command tcpdump -netti enc0 when trying to access the 172.16.0.0/16 network
• J

  IPSEC VTI tunnels lost packets
  • Jose Carlos S  

  24
  0
  Votes
  24
  Posts
  57
  Views

  J

  @pete35 Hi Pete, answers: -We work with several versions of APU, 2,3 and 4 all with 4 GB of RAM. -We only have one pfsense as VM in the architecture and coincidentally the VTIs that go against that firewall are the ones that lose the least packets. -DPD is set and is not set to test. No change. -Hash in P2. Remember that we are changing from tunnel mode to VTI mode and we are using the same configuration, in tunnel mode it works perfectly (hardware included) and in VTI mode there is packet loss. -MTU clamping set at 1400. Let's see if the behavior changes. -Pfsense has only one NAT to go internet. -We are going to capture traffic to see if we see where the ICMPs are lost. -Remember that we do not have OSPF mounted (yet), packet losses always occur, even in models reinstalled with dedicated hardware, in fact, we have now bought 6 new computers to do tests in the laboratory. Thanks for your tips.
• B

  Mobile IPSec tunnel fails on big WAN flows (MSS issue)
  • basicmonkey  

  2
  0
  Votes
  2
  Posts
  17
  Views

  B

  Shameless bump... Any ideas very much welcome. It's odd that the same config works fine elsewhere. It's not the encryption engine as I can do 300Mbit between sites LAN to LAN. It's only when WAN is involved. Thanks, James
• J

  Firewall blocking IPSec traffic
  • jauintm  

  1
  0
  Votes
  1
  Posts
  15
  Views

  No one has replied

• A

  TCP urgent pointer stiped by IPSEC?
  • adelphi  

  1
  0
  Votes
  1
  Posts
  7
  Views

  No one has replied

• D

  IPSec outbound address
  • DanAvni  

  1
  0
  Votes
  1
  Posts
  13
  Views

  No one has replied

• T

  Tunnel 2 works, but Tunnel 1 stopped working 2 days ago
  • TheWaterbug  

  1
  0
  Votes
  1
  Posts
  5
  Views

  No one has replied

• W

  Routing Openvpn Client to Site connections over an IPSEC S2S
  • wspence  

  4
  0
  Votes
  4
  Posts
  9
  Views

  W

  @viragomann Actually just did a reboot and it appears to be working now, thank you.
• J

  IPSec Menus are different
  • jauintm  

  4
  0
  Votes
  4
  Posts
  39
  Views

  

  Did you restore a configuration to the second one that was from a different device? Those packages (ipsec-profile-wizard and aws-wizard) should be present in the default installation, but if you restore a configuration that didn't have the packages, they would have been removed.
• P

  ipsec vti - weird only some data passes
  • Playmobil  

  3
  0
  Votes
  3
  Posts
  22
  Views

  P

  Hi marcquark, Yes you are right, it is a MTU problem. Upgrading to 2.4.5 and using MTU and MSS clamp, fixed the problem.