Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IKEv2 Site-to-Site and MultiWAN on one side

    IPsec
    ipsec ddns multi-wan issue
    5
    32
    2.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      OK that looks like the other end is not seeing the replies for some reason.

      Check the state table at both ends.

      Which end are those logs from?

      P 1 Reply Last reply Reply Quote 0
      • P
        patrick.pesegodinski @stephenw10
        last edited by

        @stephenw10 This is the side that has the two wans.

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Ok so it sees the incoming request on the correct WAN and replies but the other end never sees that reply because it just sends the initial request again.

          So either that reply is not actually being sent or it's send incorrectly somehow. Or something in the route is blocking it.

          I'd first check the state tables at each end. If that doesn't show something obvious then run a pcap at both ends to confirm replies are being sent and received.

          P 1 Reply Last reply Reply Quote 0
          • P
            patrick.pesegodinski @stephenw10
            last edited by

            @stephenw10 The table pfsense with two wan:

            7e4900e2-1285-4b01-882b-f4a218572915-image.png

            The table other pfsense:

            81abea08-6331-47ec-8e7a-89836b901d57-image.png

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              OK so never makes it to the firewall state at the remote end.

              Run pcaps and make sure it's leaving the multiwan end correctly.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                You might also try just pinging between those sites using that WAN as source and see if it gets to the remote side as expected.

                P 1 Reply Last reply Reply Quote 0
                • P
                  patrick.pesegodinski @stephenw10
                  last edited by

                  @stephenw10
                  I think I found the problem. I was using this configuration:

                  9862f654-a68f-4022-a8fe-10f52dbe4b88-image.png

                  Because I used 0.0.0.0 in remote gateway.

                  After I switched to, it worked.

                  29386e3d-4754-4422-927a-eafc22bbb0fb-image.png

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    You should be able to use ASN at both ends as long as it all matches.

                    P 1 Reply Last reply Reply Quote 0
                    • P
                      patrick.pesegodinski @stephenw10
                      last edited by

                      @stephenw10 With ASN, the tunnel only connects to the WAN with tier1.

                      I block the ping protocol on both WANs for external requests, could this affect the IPsec request?

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Does that ASN resolve to the other WAN IP perhaps?

                        P 1 Reply Last reply Reply Quote 0
                        • P
                          patrick.pesegodinski @stephenw10
                          last edited by

                          @stephenw10 I think so.

                          How do I test?

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Just try to resolve it somewhere. In Diag > DNS Lookup in pfSense for example.

                            If you use an IP address or something actually resolves it must match the actual address IPSec is using.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.