IPSsec between PFSense <-> Cisco

Blobot

Hello,

I need to create an IPSec tunnel between my PFSense and a remote Cisco device. The configuration is done on both side and it works !
BUT !…
... The problem is it only works when, on the Cisco, the ID = IP Address. When the Cisco is configured to send its FQDN as Identifier, the tunnel doesn not come UP. There are some depedencies that oblige us to keep the FQDN as ID on the cisco.

My question is :

How can I tell to PFSense to accept FQDN as Identifier instead of the Public IP addresse ?

Thank you in advance

Note : I'm using PFSense 1.2 RC3

Note 2 : I got those errors when the Cisco send the FQDN :
racoon: ERROR: invalid ID payload.
racoon: ERROR: Expecting IP address type in main mode, but FQDN.

Note 3 : When I try to use agressive mode I get this error :
racoon: ERROR: not acceptable Identity Protection mode

scourtney2000

there is an option in pfsense call 'My Identifier'

you will see when creating your tunnel under Phase 1 proposal.

can you post your cisco config. i can't seem to get a site to set working between my cisco asa and my pfsense.

thanks

Blobot

Thank you for your answer, I don't have the cisco conf under my hand yet but about the "My Identifier" in pfsense what should I put ? I setted "IP Address" and put the FW ip address in the box. But you think it can be the problem ? Because as I said, when the Identity is set to IP (instead of FQDN) in the Cisco, it works.

But what I don't understand is when I read the RFC 2409 section 5.4 I can see :

When using pre-shared key authentication with Main Mode the key can
only be identified by the IP address of the peers since HASH_I must
be computed before the initiator has processed IDir. Aggressive Mode
allows for a wider range of identifiers of the pre-shared secret to
be used. In addition, Aggressive Mode allows two parties to maintain
multiple, different pre-shared keys and identify the correct one for
a particular exchange.

It means that there is no possibility to tell PFSense to use FQDN for the VPN Tunnel ? If that's it, why does cisco use the FQDN ??

Thank you

scourtney2000

Interesting…from what I understand of Cisco (I am not a Cisco expert) you do have the ability to change the identifier.

In your Cisco config look for this:

At the cisco configuration terminal type:
crypto isakmp identity ?

You will see:

address Use the IP address of the interface for the identity
auto Identity automatically determined by the connection type: IP
address for preshared key and Cert DN for Cert based connections
hostname Use the hostname of the router for the identity
key-id Use the specified key-id for the identity

Blobot

That's exact ! But the problem is this option is global ! And can affect other configurations, that's why we will keep it to "hostname".

Now the question is : how to tell Pfsense to accept Hostname as identifier for a pre-shared key IPSec tunnel ??

Thank you in advance

Blobot

UP ! :)

scourtney2000

can you post your cisco config. i have never been able to get my site to site going between pfsense and my cisco asa.

thanks,
sean

clamasters

What Cisco device are you using, router?, pix?, asa?. Additionally, what OS version is running on the Cisco. Tomorrow I will upload my working pfSense 1.2RC3 - Cisco PIX 506 6.3.5. config's.

rulle_mus

Hello,

I am struggling to get ipsec working getween pfsense 1.2rc4 and Cisco 1721 with crypto ios.
Is it possible to post your IOS config?

Regards,

Mus

Fritz79

Hi everyone,

I got tunnel standing to router 1800 series with 12.4(6)T8
The problem is, that i can initiate tunnel only from pfSense side (when traffic is sent to destination private network, eg. ping tunel is set up). when tunnel is standing everythin works fine.

I have firewall WAN ESP, ipsec and LAN rules set.

Does anyone have idea ?

kirikiri

@Blobot:

UP ! :)

Could you please send me a short description of how you mananged to get it up and running?
Thanks!