Set the MSS for AES to 1328, if you want to avoid padding. Less padding allows you to move more Data over the tunnel.

Here is the log informatin I get when trying to ping from one of hte remote sites: Oct 4 08:53:19 charon 80307 12[KNL] <con3|370> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found Oct 4 08:53:19 charon 80307 12[KNL] <con3|370> querying policy ::/0|/0 === ::/0|/0 in failed, not found Oct 4 08:53:19 charon 80307 12[IKE] <con3|370> sending DPD request Oct 4 08:53:19 charon 80307 12[IKE] <con3|370> queueing IKE_DPD task Oct 4 08:53:19 charon 80307 12[IKE] <con3|370> activating new tasks Oct 4 08:53:19 charon 80307 12[IKE] <con3|370> activating IKE_DPD task Oct 4 08:53:19 charon 80307 12[ENC] <con3|370> generating INFORMATIONAL request 2250 [ ] Oct 4 08:53:19 charon 80307 12[NET] <con3|370> sending packet: from 50.169.69.234[500] to 50.169.69.203[500] (80 bytes) Oct 4 08:53:19 charon 80307 12[NET] <con3|370> received packet: from 50.169.69.203[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:19 charon 80307 12[ENC] <con3|370> parsed INFORMATIONAL response 2250 [ ] Oct 4 08:53:19 charon 80307 12[IKE] <con3|370> activating new tasks Oct 4 08:53:19 charon 80307 12[IKE] <con3|370> nothing to initiate Oct 4 08:53:22 charon 80307 12[NET] <con1|366> received packet: from 66.207.143.1[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:22 charon 80307 12[ENC] <con1|366> parsed INFORMATIONAL request 12680 [ ] Oct 4 08:53:22 charon 80307 12[ENC] <con1|366> generating INFORMATIONAL response 12680 [ ] Oct 4 08:53:22 charon 80307 12[NET] <con1|366> sending packet: from 50.169.69.234[500] to 66.207.143.1[500] (80 bytes) Oct 4 08:53:22 charon 80307 12[KNL] <con2|371> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found Oct 4 08:53:22 charon 80307 12[KNL] <con2|371> querying policy ::/0|/0 === ::/0|/0 in failed, not found Oct 4 08:53:22 charon 80307 12[IKE] <con2|371> sending DPD request Oct 4 08:53:22 charon 80307 12[IKE] <con2|371> queueing IKE_DPD task Oct 4 08:53:22 charon 80307 12[IKE] <con2|371> activating new tasks Oct 4 08:53:22 charon 80307 12[IKE] <con2|371> activating IKE_DPD task Oct 4 08:53:22 charon 80307 12[ENC] <con2|371> generating INFORMATIONAL request 1086 [ ] Oct 4 08:53:22 charon 80307 12[NET] <con2|371> sending packet: from 50.169.69.234[500] to 50.169.69.219[500] (80 bytes) Oct 4 08:53:22 charon 80307 12[NET] <con2|371> received packet: from 50.169.69.219[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:22 charon 80307 12[ENC] <con2|371> parsed INFORMATIONAL response 1086 [ ] Oct 4 08:53:22 charon 80307 12[IKE] <con2|371> activating new tasks Oct 4 08:53:22 charon 80307 12[IKE] <con2|371> nothing to initiate Oct 4 08:53:27 charon 80307 11[IKE] <con4|372> sending DPD request Oct 4 08:53:27 charon 80307 11[IKE] <con4|372> queueing IKE_DPD task Oct 4 08:53:27 charon 80307 11[IKE] <con4|372> activating new tasks Oct 4 08:53:27 charon 80307 11[IKE] <con4|372> activating IKE_DPD task Oct 4 08:53:27 charon 80307 11[ENC] <con4|372> generating INFORMATIONAL request 93 [ ] Oct 4 08:53:27 charon 80307 11[NET] <con4|372> sending packet: from 50.169.69.234[500] to 192.158.19.11[500] (80 bytes) Oct 4 08:53:27 charon 80307 11[NET] <con1|366> received packet: from 66.207.143.1[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:27 charon 80307 11[ENC] <con1|366> parsed INFORMATIONAL request 12681 [ ] Oct 4 08:53:27 charon 80307 11[ENC] <con1|366> generating INFORMATIONAL response 12681 [ ] Oct 4 08:53:27 charon 80307 11[NET] <con1|366> sending packet: from 50.169.69.234[500] to 66.207.143.1[500] (80 bytes) Oct 4 08:53:27 charon 80307 11[NET] <con4|372> received packet: from 192.158.19.11[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:27 charon 80307 11[ENC] <con4|372> parsed INFORMATIONAL response 93 [ ] Oct 4 08:53:27 charon 80307 11[IKE] <con4|372> activating new tasks Oct 4 08:53:27 charon 80307 11[IKE] <con4|372> nothing to initiate Oct 4 08:53:29 charon 80307 11[KNL] <con3|370> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found Oct 4 08:53:29 charon 80307 11[KNL] <con3|370> querying policy ::/0|/0 === ::/0|/0 in failed, not found Oct 4 08:53:29 charon 80307 11[IKE] <con3|370> sending DPD request Oct 4 08:53:29 charon 80307 11[IKE] <con3|370> queueing IKE_DPD task Oct 4 08:53:29 charon 80307 11[IKE] <con3|370> activating new tasks Oct 4 08:53:29 charon 80307 11[IKE] <con3|370> activating IKE_DPD task Oct 4 08:53:29 charon 80307 11[ENC] <con3|370> generating INFORMATIONAL request 2251 [ ] Oct 4 08:53:29 charon 80307 11[NET] <con3|370> sending packet: from 50.169.69.234[500] to 50.169.69.203[500] (80 bytes) Oct 4 08:53:29 charon 80307 11[NET] <con3|370> received packet: from 50.169.69.203[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:29 charon 80307 11[ENC] <con3|370> parsed INFORMATIONAL response 2251 [ ] Oct 4 08:53:29 charon 80307 11[IKE] <con3|370> activating new tasks Oct 4 08:53:29 charon 80307 11[IKE] <con3|370> nothing to initiate Oct 4 08:53:32 charon 80307 11[NET] <con1|366> received packet: from 66.207.143.1[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:32 charon 80307 11[ENC] <con1|366> parsed INFORMATIONAL request 12682 [ ] Oct 4 08:53:32 charon 80307 11[ENC] <con1|366> generating INFORMATIONAL response 12682 [ ] Oct 4 08:53:32 charon 80307 11[NET] <con1|366> sending packet: from 50.169.69.234[500] to 66.207.143.1[500] (80 bytes) Oct 4 08:53:32 charon 80307 11[KNL] <con2|371> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found Oct 4 08:53:32 charon 80307 11[KNL] <con2|371> querying policy ::/0|/0 === ::/0|/0 in failed, not found Oct 4 08:53:32 charon 80307 11[IKE] <con2|371> sending DPD request Oct 4 08:53:32 charon 80307 11[IKE] <con2|371> queueing IKE_DPD task Oct 4 08:53:32 charon 80307 11[IKE] <con2|371> activating new tasks Oct 4 08:53:32 charon 80307 11[IKE] <con2|371> activating IKE_DPD task Oct 4 08:53:32 charon 80307 11[ENC] <con2|371> generating INFORMATIONAL request 1087 [ ] Oct 4 08:53:32 charon 80307 11[NET] <con2|371> sending packet: from 50.169.69.234[500] to 50.169.69.219[500] (80 bytes) Oct 4 08:53:32 charon 80307 11[NET] <con2|371> received packet: from 50.169.69.219[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:32 charon 80307 11[ENC] <con2|371> parsed INFORMATIONAL response 1087 [ ] Oct 4 08:53:32 charon 80307 11[IKE] <con2|371> activating new tasks Oct 4 08:53:32 charon 80307 11[IKE] <con2|371> nothing to initiate Oct 4 08:53:37 charon 80307 11[IKE] <con4|372> sending DPD request Oct 4 08:53:37 charon 80307 11[IKE] <con4|372> queueing IKE_DPD task Oct 4 08:53:37 charon 80307 11[IKE] <con4|372> activating new tasks Oct 4 08:53:37 charon 80307 11[IKE] <con4|372> activating IKE_DPD task Oct 4 08:53:37 charon 80307 11[ENC] <con4|372> generating INFORMATIONAL request 94 [ ] Oct 4 08:53:37 charon 80307 11[NET] <con4|372> sending packet: from 50.169.69.234[500] to 192.158.19.11[500] (80 bytes) Oct 4 08:53:37 charon 80307 09[NET] <con1|366> received packet: from 66.207.143.1[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:37 charon 80307 09[ENC] <con1|366> parsed INFORMATIONAL request 12683 [ ] Oct 4 08:53:37 charon 80307 09[ENC] <con1|366> generating INFORMATIONAL response 12683 [ ] Oct 4 08:53:37 charon 80307 09[NET] <con1|366> sending packet: from 50.169.69.234[500] to 66.207.143.1[500] (80 bytes) Oct 4 08:53:37 charon 80307 09[NET] <con4|372> received packet: from 192.158.19.11[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:37 charon 80307 09[ENC] <con4|372> parsed INFORMATIONAL response 94 [ ] Oct 4 08:53:37 charon 80307 09[IKE] <con4|372> activating new tasks Oct 4 08:53:37 charon 80307 09[IKE] <con4|372> nothing to initiate Oct 4 08:53:39 charon 80307 09[KNL] <con3|370> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found Oct 4 08:53:39 charon 80307 09[KNL] <con3|370> querying policy ::/0|/0 === ::/0|/0 in failed, not found Oct 4 08:53:39 charon 80307 09[IKE] <con3|370> sending DPD request Oct 4 08:53:39 charon 80307 09[IKE] <con3|370> queueing IKE_DPD task Oct 4 08:53:39 charon 80307 09[IKE] <con3|370> activating new tasks Oct 4 08:53:39 charon 80307 09[IKE] <con3|370> activating IKE_DPD task Oct 4 08:53:39 charon 80307 09[ENC] <con3|370> generating INFORMATIONAL request 2252 [ ] Oct 4 08:53:39 charon 80307 09[NET] <con3|370> sending packet: from 50.169.69.234[500] to 50.169.69.203[500] (80 bytes) Oct 4 08:53:39 charon 80307 09[NET] <con3|370> received packet: from 50.169.69.203[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:39 charon 80307 09[ENC] <con3|370> parsed INFORMATIONAL response 2252 [ ] Oct 4 08:53:39 charon 80307 09[IKE] <con3|370> activating new tasks Oct 4 08:53:39 charon 80307 09[IKE] <con3|370> nothing to initiate Oct 4 08:53:42 charon 80307 09[NET] <con1|366> received packet: from 66.207.143.1[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:42 charon 80307 09[ENC] <con1|366> parsed INFORMATIONAL request 12684 [ ] Oct 4 08:53:42 charon 80307 09[ENC] <con1|366> generating INFORMATIONAL response 12684 [ ] Oct 4 08:53:42 charon 80307 09[NET] <con1|366> sending packet: from 50.169.69.234[500] to 66.207.143.1[500] (80 bytes) Oct 4 08:53:42 charon 80307 09[KNL] <con2|371> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found Oct 4 08:53:42 charon 80307 09[KNL] <con2|371> querying policy ::/0|/0 === ::/0|/0 in failed, not found Oct 4 08:53:42 charon 80307 09[IKE] <con2|371> sending DPD request Oct 4 08:53:42 charon 80307 09[IKE] <con2|371> queueing IKE_DPD task Oct 4 08:53:42 charon 80307 09[IKE] <con2|371> activating new tasks Oct 4 08:53:42 charon 80307 09[IKE] <con2|371> activating IKE_DPD task Oct 4 08:53:42 charon 80307 09[ENC] <con2|371> generating INFORMATIONAL request 1088 [ ] Oct 4 08:53:42 charon 80307 09[NET] <con2|371> sending packet: from 50.169.69.234[500] to 50.169.69.219[500] (80 bytes) Oct 4 08:53:42 charon 80307 09[NET] <con2|371> received packet: from 50.169.69.219[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:42 charon 80307 09[ENC] <con2|371> parsed INFORMATIONAL response 1088 [ ] Oct 4 08:53:42 charon 80307 09[IKE] <con2|371> activating new tasks Oct 4 08:53:42 charon 80307 09[IKE] <con2|371> nothing to initiate Oct 4 08:53:47 charon 80307 09[IKE] <con4|372> sending DPD request Oct 4 08:53:47 charon 80307 09[IKE] <con4|372> queueing IKE_DPD task Oct 4 08:53:47 charon 80307 09[IKE] <con4|372> activating new tasks Oct 4 08:53:47 charon 80307 09[IKE] <con4|372> activating IKE_DPD task Oct 4 08:53:47 charon 80307 09[ENC] <con4|372> generating INFORMATIONAL request 95 [ ] Oct 4 08:53:47 charon 80307 09[NET] <con4|372> sending packet: from 50.169.69.234[500] to 192.158.19.11[500] (80 bytes) Oct 4 08:53:47 charon 80307 09[NET] <con1|366> received packet: from 66.207.143.1[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:47 charon 80307 09[ENC] <con1|366> parsed INFORMATIONAL request 12685 [ ] Oct 4 08:53:47 charon 80307 09[ENC] <con1|366> generating INFORMATIONAL response 12685 [ ] Oct 4 08:53:47 charon 80307 09[NET] <con1|366> sending packet: from 50.169.69.234[500] to 66.207.143.1[500] (80 bytes) Oct 4 08:53:47 charon 80307 09[NET] <con4|372> received packet: from 192.158.19.11[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:47 charon 80307 09[ENC] <con4|372> parsed INFORMATIONAL response 95 [ ] Oct 4 08:53:47 charon 80307 09[IKE] <con4|372> activating new tasks Oct 4 08:53:47 charon 80307 09[IKE] <con4|372> nothing to initiate Oct 4 08:53:49 charon 80307 09[KNL] <con3|370> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found Oct 4 08:53:49 charon 80307 09[KNL] <con3|370> querying policy ::/0|/0 === ::/0|/0 in failed, not found Oct 4 08:53:49 charon 80307 09[IKE] <con3|370> sending DPD request Oct 4 08:53:49 charon 80307 09[IKE] <con3|370> queueing IKE_DPD task Oct 4 08:53:49 charon 80307 09[IKE] <con3|370> activating new tasks Oct 4 08:53:49 charon 80307 09[IKE] <con3|370> activating IKE_DPD task Oct 4 08:53:49 charon 80307 09[ENC] <con3|370> generating INFORMATIONAL request 2253 [ ] Oct 4 08:53:49 charon 80307 09[NET] <con3|370> sending packet: from 50.169.69.234[500] to 50.169.69.203[500] (80 bytes) Oct 4 08:53:49 charon 80307 10[NET] <con3|370> received packet: from 50.169.69.203[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:49 charon 80307 10[ENC] <con3|370> parsed INFORMATIONAL response 2253 [ ] Oct 4 08:53:49 charon 80307 10[IKE] <con3|370> activating new tasks Oct 4 08:53:49 charon 80307 10[IKE] <con3|370> nothing to initiate Oct 4 08:53:52 charon 80307 10[NET] <con1|366> received packet: from 66.207.143.1[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:52 charon 80307 10[ENC] <con1|366> parsed INFORMATIONAL request 12686 [ ] Oct 4 08:53:52 charon 80307 10[ENC] <con1|366> generating INFORMATIONAL response 12686 [ ] Oct 4 08:53:52 charon 80307 10[NET] <con1|366> sending packet: from 50.169.69.234[500] to 66.207.143.1[500] (80 bytes) Oct 4 08:53:52 charon 80307 10[KNL] <con2|371> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found Oct 4 08:53:52 charon 80307 10[KNL] <con2|371> querying policy ::/0|/0 === ::/0|/0 in failed, not found Oct 4 08:53:52 charon 80307 10[IKE] <con2|371> sending DPD request Oct 4 08:53:52 charon 80307 10[IKE] <con2|371> queueing IKE_DPD task Oct 4 08:53:52 charon 80307 10[IKE] <con2|371> activating new tasks Oct 4 08:53:52 charon 80307 10[IKE] <con2|371> activating IKE_DPD task Oct 4 08:53:52 charon 80307 10[ENC] <con2|371> generating INFORMATIONAL request 1089 [ ] Oct 4 08:53:52 charon 80307 10[NET] <con2|371> sending packet: from 50.169.69.234[500] to 50.169.69.219[500] (80 bytes) Oct 4 08:53:52 charon 80307 10[NET] <con2|371> received packet: from 50.169.69.219[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:52 charon 80307 10[ENC] <con2|371> parsed INFORMATIONAL response 1089 [ ] Oct 4 08:53:52 charon 80307 10[IKE] <con2|371> activating new tasks Oct 4 08:53:52 charon 80307 10[IKE] <con2|371> nothing to initiate Oct 4 08:53:57 charon 80307 10[IKE] <con4|372> sending DPD request Oct 4 08:53:57 charon 80307 10[IKE] <con4|372> queueing IKE_DPD task Oct 4 08:53:57 charon 80307 10[IKE] <con4|372> activating new tasks Oct 4 08:53:57 charon 80307 10[IKE] <con4|372> activating IKE_DPD task Oct 4 08:53:57 charon 80307 10[ENC] <con4|372> generating INFORMATIONAL request 96 [ ] Oct 4 08:53:57 charon 80307 10[NET] <con4|372> sending packet: from 50.169.69.234[500] to 192.158.19.11[500] (80 bytes) Oct 4 08:53:57 charon 80307 10[NET] <con1|366> received packet: from 66.207.143.1[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:57 charon 80307 10[ENC] <con1|366> parsed INFORMATIONAL request 12687 [ ] Oct 4 08:53:57 charon 80307 10[ENC] <con1|366> generating INFORMATIONAL response 12687 [ ] Oct 4 08:53:57 charon 80307 10[NET] <con1|366> sending packet: from 50.169.69.234[500] to 66.207.143.1[500] (80 bytes) Oct 4 08:53:57 charon 80307 10[NET] <con4|372> received packet: from 192.158.19.11[500] to 50.169.69.234[500] (80 bytes) Oct 4 08:53:57 charon 80307 10[ENC] <con4|372> parsed INFORMATIONAL response 96 [ ] Oct 4 08:53:57 charon 80307 10[IKE] <con4|372> activating new tasks Oct 4 08:53:57 charon 80307 10[IKE] <con4|372> nothing to initiate

Yeah, once I got it configured correctly with the multiple phase 2 connections it was rock solid. Bomb-proof even.

@viragomann Ops! Thanks will correct

Well I believe I sorted it at this point. Because the old FW has multiple IPsec tunnels, a few non VTI, I couldn't enable IPsec Filter Mode. While looking over logs, I noticed that my traffic was entering VTI interface and leaving IPSec interface. So I created a floating rule for asymmetrical routing issues. All I needed to do was alter my IPSEC rules to match any/any TCP:Any, State:Sloppy.

@michmoor I won't argue with you, be polite. That's all.

@adebisi Firewall > Rules, IPsec Rules on that tab govern what connections are allowed into your firewall from IPsec tunnels. There is no way to know what might be required at the other side. You'll have to work with them on that.

@michmoor Fairly new and green with working with pfense. What should I change the update source for the Neighbours BGP ?

@viragomann Well, since I couldn't get the default one to work, I tried VTI and it worked. Not sure what I did wrong with the other method but I did find VTI a bit more like the WG tunnels I have set up in the past. With the gateway and routing settings at least...

@dnacom The next release would usually include the patch. You can either leave the patches installed and upgrade (will then still show the patch as installed in system patches) or revert the patches before upgrading and then upgrade as normal. Hope that makes sense

@keyser Thank you for your reply! Yes, I need those options for split routing. The Windows VPN client is just capable of class based routing and ignores pushed routes. So per default it just adds a class based route to the remote net and ignores everything else except ip address. Here is an excerpt from the Strongswan documentation: Split Routing since Windows 10 Microsoft changed the Windows 10 VPN routing behavior for new VPN connections. Option "Use default gateway on remote network option" in the Advanced TCP/IP settings of the VPN connection is now disabled by default but can be enabled if desired. Fortunately Windows sends a DHCP request upon connection and add routes supplied in option 249 of the DHCP reply. Sample configuration file for dnsmasq: dhcp-vendorclass=set:msipsec,MSFT 5.0 dhcp-range=tag:msipsec,192.168.103.0,static dhcp-option=tag:msipsec,6 dhcp-option=tag:msipsec,249, 0.0.0.0/1,0.0.0.0, 128.0.0.0/1,0.0.0.0 where 192.168.103.0 is your (internal) network. It pushes two separate routes which cover the entire IPv4 range. Gateway could be anything (set to 0.0.0.0 in an example) as it is ignored by Windows. Note that you can’t ignore DHCP routes in Windows. Strongswan Documentation for Windows clients In my opinion this can only be achieved with the dhcp plugin. So for supporting Windows clients without configuring something manually, you need dhcp.

@viragomann said in IPSec VPN Client and access to office server: The settings are wrong. You need to state local network: 192.168.109.0/24 remote: 192.168.89.0/24 Remember to configure the second p 2 on the remote site as well with exchanged networks. Many Thanks, this is good setting, now work both Phase 2 and VPN Client has access to server 192.168.173.0/24 and to Synology 192.168.173.0/24 site.

@movIT You are probably limited by the GUI. You could go here : Status > System Logs > Settings and change [image: 1725431946352-c5dad0b9-bcbc-4136-8867-484d78c846fc-image.png] to something a bit bigger. Check also this : [image: 1725431976584-4280c79f-7433-4ea4-b1c1-6f317c100f08-image.png] where you can set overall log file size. If you have many G bytes to spare, you can make these files a bit bigger. On very small devices : be carefull. But you can also apply the "IT" way : you don't care about GUI ... go native access right away. Go to the source. Use the console, or, like everybody else, use the SSH access, and look her /var/log/ as that is the place where logs are stored on nearly every "computer" on planet earth. You'll find the system.log file. Btw : typically, I have 20-30 lines a day in the System log file. So "only the last 5 minutes worth" is pretty strange : what is happening in there that your pfSense logs that much ? ? Massive logs == normally : an indication something not-ok is going on.