Tunnel stopped working and I can't figure out why

24fun · Aug 23, 2023, 6:30 AM

I have IPSEC tunnels between multiple pfsense firwalls, and all worked fine until a few days ago one tunnel stopped working. It is really couriour, I cannot access Site A from site B and vice versa but it is no problem to reach A from C and B from C and I also can reach C from both sites A and B.

The tunnels are als set up in the same matter, here are a few details, maybe someone sees something I overlook:

Here is the status of site A, there are no packets out

Here is the status of site B, ** there are no packets in and out**

Here is the IPSEC log for site A, there seems to be traffic in both directions isn't?

Here is the IPSEC log for site B, there is also traffic:

So my first question: when there are packets sent in both directions, why the counters are 0 ?

Traced packet trace at site A

Packet trace at site B - only UDP no ESP .... why?

If someone can give any hint this would greatly appreciated, if someone needs more information, please write. Thank you so much!

Topogigio · Aug 23, 2023, 9:09 AM

@24fun how are you routing tables and tracerts?

I'm experiencing a lot lot lot of crazy problem with ipsec + routing after upgrade to 2.7

24fun · Aug 23, 2023, 2:14 PM

In the meantime i figured out, that setting the "NAT Traversal" in Site B from "Auto" to "Forced" in phase 1 settings, solved my problem. Curious, all other tunnels are running with this "auto" setting. ????

planedrop · Aug 23, 2023, 10:30 PM

I've had no issues with IPSec on pf Plus at least, don't have a 2.7 system to test right now though, but that NAT setting normally shouldn't have to be adjusted.

Just out of curiosity, are you seeing any MAC auth errors?

I had an issue a while back, still not sure if it's solved or not (made a post with no responses) and haven't been able to test, but for some reason I was getting a ton of auth issues after updating pfSense to a newer version when it comes to IPSec, turned out that for some reason the option of using "My IP Address" wasn't properly authenticating and I had to manually specify the IP.

Anyway, seems like that's not related to your issue but just wanted to double check since it was something I ran across and never managed to solve.

Edit: here is that post I made: https://forum.netgate.com/topic/176502/had-to-manually-specify-identifier-ip-address-no-nat-involved-bug

Another edit: this does appear to have been resolved, just got it working when before it wouldn't.