Ipsec Configuration not Working!
-
@gabacho4 Yes, Any to Any rule is applied on both sites within IPsec interface
-
@ibnkamala OK so now is about the point at which I say, update the 2.4.5 box to 2.6 before we can do any more troubleshooting. I don't want to spend any more time trying to force this and hope that both versions are speaking the same ipsec language. Please update and then let us know where things stand.
-
@gabacho4 I wanted to post you the logs while time is matched but couldn't it says it's a SPAM. I don't know if there is a way to upload them as a PDF?
but Monday I will update 2.4.5 to 2.6 and for sure will update you of the outcome
-
@gabacho4 SiteA and SiteB Logs.zip
Here are the logs if you have some time please let me know if you get something from !
-
Thank you so much for your great help, have nice weekend @gabacho4
-
I'm tuning in and grabbing popcorn for this one.
@ibnkamala you say here that "both sides are behind NAT". I'm trying to wrap my head around how this is expected to work. IPsec uses static outbound ports so having >1 Phase1 behind a single NAT shouldn't really be possible without some crazy configuration involving port forwarding and outbound NAT on both sides. Later on you state "I really don't know what our partner uses in the other side of the tunnel" ... so
And then on top of it you're running a 2+ year old version on one end...
-
@luckman212 having both routers behind NAT should work fine. I believe I’ve done it in the past. The key however is you have to set that identifier to a KeyID instead of IP address. Googling produces a hit that supports my belief/understanding.
https://networkengineering.stackexchange.com/questions/70626/is-an-ipsec-connection-between-2-devices-behind-nat-possible
I’m strongly inclined to believe the OP has an interoperability issue due to the different pfsense versions. More than happy play with @ibnkamala more once we are comparing apples to apples.
-
@gabacho4 I can see how a single IPsec P1 could be made to work where both sides are using NAT-T but I am failing to understand how you could have multiple working P1s like that. I admit I haven't seen the KeyID method you linked to used in the wild so maybe I'm just unaware of that. Anyway, curious how this ends up.
-
@luckman212 I am as well. Enjoy the show! Either we emerge victorious or I lose my sanity.
-
@gabacho4 and @luckman212 since you spoke about NAT and port forwarding I decided to share with you my infra. in both sides to have a clear picture of what I have.
@gabacho4 I hope I did not give you wrong information, if so I apologize in advance
-
@ibnkamala why are you making things harder than they need to be? why not replace the "simple internet box" with the pfsense VM and connect IPSEC directly to the Sonicwall on the other end (no NAT required)
Am I missing something?
-
@luckman212 how can I replace internetBox by Pfsense/vm? your point was siteA right?
-
@ibnkamala just unplug "simple internet box" and enable dhcp on your pfsense VM. You will need 2 NICs on there so you can have LAN/WAN or you'll need to use VLANs and have a VLAN-capable switch (I'm guessing you may not have this)
Yes I am talking about SiteA. I assume you have no direct control over SiteB but I hope that you are at least able to coordinate with whoever controls the Sonicwall to have them set up the tunnel and provide you with the P1/P2 settings.
-
@luckman212 sadly I only have one NIC on the workstation that I have pfsense on. (However in reality siteA will be behind NAT)
Yes I do have direct access to the SiteB, you want me to use SonicWall for the IPsec instead pfsense?
-
@gabacho4 and @luckman212 also for your information when I check the port with the Public IPs:
SiteB is open,
But SiteA is closed! do you think this is what makes the problem? and since it's a simple internetBox I do not have a firewall to ope the ports at all.
-
This post is deleted! -
This post is deleted! -
@gabacho4 now both sides are running on 2.6.
🔒 Log in to view
🔒 Log in to viewBut still not working!
For your information when I check the port with the Public IPs here https://www.yougetsignal.com/tools/open-ports/:
SiteB is open
But SiteA is closed! do you think this is what makes the problem? and since it's a simple internetBox I do not have a firewall to ope the ports at all.
-
@ibnkamala sorry just got home from work. So it appears in the last screenshot that both the P1s are connected. That would seem better than it was before. Can you show me the logs so I can see what the P2 is doing? I’m not going to lie to you, your setup is insanely more complicated than I’d ever use. Why would you have pfsense behind another firewall and other hardware? And what is an internet box? A modem? A router? An ONT?
-
@ibnkamala Ok so I did some Googling. Are you located in Switzerland? I find a internetBox that the ISP in Switzerland offers. If not Switzerland perhaps you are in another European country where the internetBox is used. If you have the device I have found, you can most certainly do port forwarding and/or set up a DMZ. I can't find anything about Ipsec passthrough but it's either there or a DMZ/port forwarding would get the job done.
Some advice - except for art, less is not more. I'm a little tweaked to find out you're using virtualized instances of pfsense that are behind multiple devices etc. Should have asked more about your setup at the beginning but for the next time, cough up all the details from the get go please.