IPsec

• S

  Multiple Concurrent VPN connection L2TP/IPsec
  • sthe  

  1
  0
  Votes
  1
  Posts
  27
  Views

  No one has replied

• T

  Static ip for a mobile client
  • trumee  

  6
  0
  Votes
  6
  Posts
  79
  Views

  T

  This seemed to have helped with the DNS issue.
• E

  IPSEC tunnel broken after uprade from 2.3.5 to 2.4.4
  • ercan412  

  2
  0
  Votes
  2
  Posts
  55
  Views

  E

  It became up after a while, I didn't change anything. Issue resolved.
• N

  Vpn site to site pfsense and checkpoint
  • namnguyen  

  1
  0
  Votes
  1
  Posts
  28
  Views

  No one has replied

• M

  OSPFv6 over IPsec VTIs
  • MeCJay12  

  6
  0
  Votes
  6
  Posts
  58
  Views

  

  That was only true for IKEv1 tunnels. IKEv2 tunnels can carry both. And VTI is not really a "tunnel" but routed IPsec so it's different yet.
• I

  IPSEC Mobile VPN routing all traffic down another IPSEC tunnel.
  • itdept211  

  2
  0
  Votes
  2
  Posts
  46
  Views

  

  Is the site-to-site tunnel using IKEv2? If so, check the "split connections" box in the P1 settings.
• E

  VPN IPSec iOS 13 VPN on Demand from App
  • egoisst  

  2
  0
  Votes
  2
  Posts
  55
  Views

  E

  Tutorial: https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/configuring-an-ipsec-remote-access-mobile-vpn-using-ikev1-xauth.html but i had to change some options:
• M

  NAT/BINAT
  • mobydick426  

  8
  0
  Votes
  8
  Posts
  151
  Views

  M

  I think I found the solution ! In the outbound NAT. I'll check.
• P

  Multi Site Multi WAN Multi VPN - Help Please
  • Paulk201270  

  1
  0
  Votes
  1
  Posts
  33
  Views

  No one has replied

• O

  Draytek on dynamic IP to pfSense on static IP VPN?
  • orangehand  

  1
  0
  Votes
  1
  Posts
  25
  Views

  No one has replied

• T

  Log filling with querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
  • trumee  

  1
  0
  Votes
  1
  Posts
  34
  Views

  No one has replied

• F

  No connection to IPSec
  • Fug1  

  2
  0
  Votes
  2
  Posts
  35
  Views

  F

  Sigh, ignore this post...it looks like the router I'm using doesn't support IPSec.
• N

  IPSec tunnels work for several hours to days but then stop routing traffic
  • nbegley  

  10
  0
  Votes
  10
  Posts
  233
  Views

  D

  @nbegley I'm not sure why you disable PFS Disable Rekey Disable Reauth or set Responder Only. The more change you make to pfSense's default settings the less chance you'll keep tunnels connected. According to my test (10 years ago), Draytek is compatible to pfSense, but I suggest you do your own interoperability test. -- Set margin time = 30s. -- Set short lifetime, like 30m Phase 1 and 15m Phase 2. -- Do not set Responder Only. Don't Disable Reauth, Disable Rekey or turn off PFS. -- (Just for the purpose of testing) Use different ciphersuit for Phase 1 and Phase 2 (say, DH group 15 and 14 respectively). If the tunnel can't be established or stops working after 1h, problem is yours. If it stops after 2 days, go after your ISP.
• D

  RRAS to pfSense on Azure VM. no virtual IP found for %any
  • dilenjoy  

  1
  0
  Votes
  1
  Posts
  68
  Views

  No one has replied

• L

  one way traffic between Unifi USG and pfsense ipsec
  dsaf • • lgreytak  

  2
  0
  Votes
  2
  Posts
  88
  Views

  L

  this is still a issue
• P

  Mobile clients with OTP
  • pama  

  9
  0
  Votes
  9
  Posts
  493
  Views

  A

  Hi @Hobby-Student What do you mean with not complete? I found out, that you need to change the "ntlm_auth" here: freeradius.inc and the other things like the QR Code are not complete. I do it by hand. So far it works. All paths are for pfsense by the way. Thanks for the answer. Regards Alitai
• S

  multi Phase 2 with vti IPsec and tunnel for Site-to-Site IPsec for Internet Traffic
  • seitle  

  1
  0
  Votes
  1
  Posts
  35
  Views

  No one has replied

• J

  Ikev2 eap-mschapv2 on multiple interfaces? Possible?
  • jaywest  

  2
  0
  Votes
  2
  Posts
  384
  Views

  F

  Hello, Thread necromancer here with the same question. I have successfully followed this guide: https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/configuring-an-ipsec-remote-access-mobile-vpn-using-ikev2-with-eap-mschapv2.html#Create_Client_Pre-Shared_Keys, and have had an IKEv2 P1 setup for years. I have a segmented network and allowing LAN access to loop back to the WAN interface was creating odd exceptions that allow a LAN user to have access to services that would be blocked by normal WAN rules, so I explicitly block LAN to WAN_address from a floating rule. I now want to allow IKEv2 from LAN into secure segments but I can only bind my P1 to one interface. No worries. I got to setup a second P1 on accessible interface and run into the same thing as the OP. I presented with a 'remote gateway address' option and no EAP options. It's as if pfSense is presuming any additional P1 are always going to be a client as a oppose to the already created server. I may be thinking about this wrong, any help appreciated.
• 

  Masquerade two different local nets into IPSEC tunnel [solved]
  • pmisch  

  4
  0
  Votes
  4
  Posts
  87
  Views

  

  Hi, almost cross posting here . Because this need some visibility so other don't have to waste hours finding out that Cisco may needs this option with multiple phase 2 for a stable connection. Ref: https://forum.netgate.com/topic/132546/ipsec-phase2-problem-pfsense-checkpoint a slight hijack of this thread from me. Split Connection was the solution to my problems too. IKE2, multiple phase 2 and Cisco ASA don't play well together (single phase 2 had no problems). This particular connection has now bean stable, 14h and counting. Brgs,
• R

  IPSec phase2 problem - pfSense - Checkpoint
  • Rosla  

  10
  0
  Votes
  10
  Posts
  308
  Views

  

  Hi ladies and germs. Split Connection was the solution to my problems. IKE2, multiple phase 2 and Cisco ASA don't play well together (single phase 2 had no problems). Split Connection is what got my connection stable, 14h and counting now. A link from the pfsense UI to the docs or a hint in the description on the option that Cisco probably needs this when running multiple phase 2 had been very helpful and saved me a couple of hours. Brgs,
• O

  Active Phase 2s do not match traffic flowing across tunnel
  • omber  

  1
  0
  Votes
  1
  Posts
  48
  Views

  No one has replied

• B

  duplicate tunnels
  • bbrendon  

  10
  0
  Votes
  10
  Posts
  103
  Views

  B

  I'm going to have to google some of the things you talked about. I set reauth = no and rekey = no. Its been about 2 days and do far so good no reboots needed and no duplicate tunnels creeping up.
• U

  pfSense to Sonicwall with failover on Sonicwall
  • unsichtbarre  

  3
  0
  Votes
  3
  Posts
  42
  Views

  U

  @Perforado thanks for the reply! The dual gateway is on the Sonicwall, not the pfSense. What I am wondering is how to best leverage Sonicwall failover to a site pfSense IP.
• D

  ipsec1000 down
  • digitalcomposer  

  2
  0
  Votes
  2
  Posts
  49
  Views

  D

  Solved.
• M

  How to setup multiple concurrent L2TP users?
  ipsec vpn l2tp • • Memes11  

  2
  0
  Votes
  2
  Posts
  37
  Views

  M

  I could not find my previous post, I thought it was not posted properly, now I found it but can not remove this one... please Admin, remove it and pardon my mistake
• L

  Can pfSense on PC Engines APU2 pass ipsec packets from internal router?
  ipsec router standalone • • linxpatrick  

  1
  0
  Votes
  1
  Posts
  38
  Views

  No one has replied

• A

  IKEv2 Certificate + EAP (Username/Password) and freeradius
  • Alitai  

  4
  0
  Votes
  4
  Posts
  121
  Views

  

  Correct. You can choose from either EAP-TLS which has certificates in both directions (client and server) or EAP-MSCHAPv2/EAP-RADIUS which has user auth + clients validate server certificate. There isn't a way for both to work currently. (And even if strongSwan supported it, I'm not sure any clients do)
• M

  Multiple Concurrent VPN connection L2TP/IPsec
  ipsec vpn l2tp • • Memes11  

  1
  0
  Votes
  1
  Posts
  57
  Views

  No one has replied

• A

  Strange Problem With Copying Files on IPSec
  • acp  

  1
  0
  Votes
  1
  Posts
  42
  Views

  No one has replied

• S

  How to config 2 or more dailup IPSec VPN tunnel using Remote gateway IP-0.0.0.0 ? The error is showning " The following input errors were detected: The remote gateway "0.0.0.0" is already used by phase1 "DAILUP-2"."
  • sandeepvkm  

  6
  0
  Votes
  6
  Posts
  162
  Views

  

  no idea sorry, as jimp mentioned 0.0.0.0 is used for other stuff inside pfsense, you need to wait for the dev to find a better solution or use dyndns
• T

  Odd One way IPSec Communication issue
  • tpayne  

  10
  1
  Votes
  10
  Posts
  57
  Views

  T

  @jimp Yup, i was just typing up a response saying I found that while reviewing my post. It's always the little things. thanks for guiding me through the troubleshooting steps! edit: It also was set to "LAN Address" instead of "LAN Net"
• P

  IPSEC VTI Interface neighbor MTU 1500 is larger then ipsec2000´s MTU 1400
  • pete35  

  5
  0
  Votes
  5
  Posts
  45
  Views

  P

  @jimp said in IPSEC VTI Interface neighbor MTU 1500 is larger then ipsec2000´s MTU 1400: affe8a552ef1f7b8e59f3b60fd1421aa46f45b03 Done. Thank you.
• S

  Voice Traffic Over IPSEC Tunnel
  • SavvyGolfer  

  1
  0
  Votes
  1
  Posts
  41
  Views

  No one has replied

• R

  IPSec/L2TP listen address 0.0.0.0 on reboot
  • raab  

  8
  0
  Votes
  8
  Posts
  114
  Views

  R

  Was able to get internal clients connecting just by adding a host override for my vpn domain name to point to pfsense e.g. 192.168.1.1 instead of trying to come in via the WAN IP Not sure what I achieved in the end, but happy days..
• B

  Bug? - Different PSK per tunnel results in other IPSec tunnels to become unavailable.
  • billsecond  

  9
  0
  Votes
  9
  Posts
  51
  Views

  

  No wonder it's broken. Every tunnel should be using a unique set of identifiers. Otherwise nothing can be distinguished from each other.
• U

  Route one site over IPsec
  • unsichtbarre  

  4
  0
  Votes
  4
  Posts
  33
  Views

  

  @unsichtbarre No, I don't think you can create a phase 2 VTI and a legacy phase 2 under the same phase 1. You would need to create a new VTI based IPSEC tunnel between sites A and B and use that exclusively. Although it might be possible to run parallel IPSEC tunnels if the endpoint IP is different at one end or the other.
• B

  Route all traffic through IPSec
  • billsecond  

  2
  0
  Votes
  2
  Posts
  54
  Views

  B

  I figured it out! Because of the way that my gateways are configured, I had to set up a firewall rule for Site B's subnet on Site A's router under IPSec that has a gateway that is the same as my outbound NAT.
• ?

  IPsec Remote Access Mobile doesn't work from MacOs
  • A Former User  

  1
  0
  Votes
  1
  Posts
  25
  Views

  No one has replied

• M

  Mobile IPsec works only on second try
  • marcol  

  1
  0
  Votes
  1
  Posts
  22
  Views

  No one has replied

• N

  Virtual Address Pool in Pre-Shared Keys is not used for ipsec
  • nohimx  

  7
  0
  Votes
  7
  Posts
  194
  Views

  E

  @mlevy823 Windows Rasman use ip address instead of IKE local ID. There is no ´solution today for this problem. I use Strongswan client as a work around.