Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1.2-RC4 IPSec Tunnel problem

    Scheduled Pinned Locked Moved IPsec
    16 Posts 4 Posters 9.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      heiko
      last edited by

      with 1.2rc4 ipsec runs fine and stable, also with two static endpoints XOR and one dynamic and one static. Please doublecheck your config.

      1 Reply Last reply Reply Quote 0
      • J
        jle2005
        last edited by

        Hi heiko and thank you very much for replying to my post. It's great to hear that you got your IPSec tunnel up and running.

        Can you please describe a little about how you config your IPSec tunnel? I follow the tutorial "configuring IPsec-tunnels with 2 pfSense-systems between static IP and dynamic IP", but there is something I didnt' do right I guess.

        By looking at the error log, can you tell what were that errors all about? Thanks once again.

        1 Reply Last reply Reply Quote 0
        • H
          heiko
          last edited by

          Please post the screenshots of your webgui-tunnel

          1 Reply Last reply Reply Quote 0
          • J
            jle2005
            last edited by

            heiko, I've decided to tear down the box and rebuilt it, and if I run into this problem again I will post a screenshots for you. Thank you very much

            1 Reply Last reply Reply Quote 0
            • H
              heiko
              last edited by

              Ok, you have my attention

              1 Reply Last reply Reply Quote 0
              • F
                fastcon68
                last edited by

                I had similar problem with 1.2r3.  It was odd I only had a problem after the upgrade.  I ended up rebuilding after I save my configuration and printed it out so i could rebuild.  That is not a option now.  My  configuration is too complex now.

                i only upgrade when I run into a werid issue.  I have one issue now which I can't access the admin tool from https, from the wan side.  I have production to be concerned with and it cost too much to have it down.

                RC

                1 Reply Last reply Reply Quote 0
                • J
                  jle2005
                  last edited by

                  Hi fastcon68,

                  The weirdest part is even I'm having those error logs, my IPSec tunnel is still up and running and I can transmit data back and forth between my sites.

                  1 Reply Last reply Reply Quote 0
                  • F
                    fastcon68
                    last edited by

                    I will check my log files to see if I am getting the same errors.  I post in a few mintes.  I am waiting for the site to come up.
                    RC

                    1 Reply Last reply Reply Quote 0
                    • H
                      heiko
                      last edited by

                      @jle2005:

                      Hi fastcon68,

                      The weirdest part is even I'm having those error logs, my IPSec tunnel is still up and running and I can transmit data back and forth between my sites.

                      Fine

                      1 Reply Last reply Reply Quote 0
                      • J
                        jle2005
                        last edited by

                        Hi heiko,

                        Is it really fine? does it effect the IPSec tunnel performance at all with those error logs?

                        1 Reply Last reply Reply Quote 0
                        • H
                          heiko
                          last edited by

                          @jle2005:

                          Hi heiko,

                          Is it really fine? does it effect the IPSec tunnel performance at all with those error logs?

                          I think you have the tunnel up and running! Which error logs do you mean?

                          1 Reply Last reply Reply Quote 0
                          • J
                            jle2005
                            last edited by

                            heiko,

                            I think you have the tunnel up and running! Which error logs do you mean?

                            The error logs below and those in my previous posts.

                            Jan 29 18:20:42    racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "172.16.1.0/24[0] 192.168.1.0/24[0] proto=any dir=out"
                            Jan 29 18:20:42    racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "192.168.1.0/24[0] 172.16.1.0/24[0] proto=any dir=in"
                            Jan 29 18:20:42    racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP/Tunnel 63.252.x.x[0]->24.17.x.x[0] spi=223333855(0xd4fcddf)
                            Jan 29 18:20:42    racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP/Tunnel 24.17.x.x[0]->63.252.x.x[0] spi=101796693(0x6114b55)
                            Jan 29 18:20:42    racoon: [Unknown Gateway/Dynamic]: INFO: Update the generated policy : 192.168.1.0/24[0] 172.16.1.0/24[0] proto=any dir=in
                            Jan 29 18:20:42    racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 2 negotiation: 63.252.x.x[0]<=>24.17.x.x[0]
                            Jan 29 18:20:41    racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA expired: ESP/Tunnel 24.17.x.x[0]->63.252.x.x[0] spi=76670812(0x491e75c)
                            Jan 29 18:20:41    racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA expired: ESP/Tunnel 63.252.x.x[0]->24.17.x.x[0] spi=258166286(0xf634e0e)
                            Jan 29 18:20:41    racoon: [Unknown Gateway/Dynamic]: INFO: ISAKMP-SA established 63.252.x.x[500]-24.17.x.x[500] spi:57bbe8e812127d61:4ffe248e9b35525e
                            Jan 29 18:20:41    racoon: INFO: received Vendor ID: DPD
                            Jan 29 18:20:41    racoon: INFO: begin Aggressive mode.
                            Jan 29 18:20:41    racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 1 negotiation: 63.252.x.x[500]<=>24.17.x.x[500]
                            Jan 29 18:07:39    racoon: [Unknown Gateway/Dynamic]: INFO: ISAKMP-SA deleted 63.252.x.x[500]-24.17.x.x[500] spi:f5a70c73dbf7f17a:baa137939e863faa
                            Jan 29 18:07:38    racoon: [Unknown Gateway/Dynamic]: INFO: ISAKMP-SA expired 63.252.x.x[500]-24.17.x.x[500] spi:f5a70c73dbf7f17a:baa137939e863faa
                            Jan 29 18:03:20    racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA expired: ESP/Tunnel 24.17.x.x[0]->63.252.x.x[0] spi=27709746(0x1a6d132)
                            Jan 29 18:03:20    racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA expired: ESP/Tunnel 63.252.x.x[0]->24.17.x.x[0] spi=156434038(0x952fe76)
                            Jan 29 18:03:20    racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "172.16.1.0/24[0] 192.168.1.0/24[0] proto=any dir=out"
                            Jan 29 18:03:20    racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "192.168.1.0/24[0] 172.16.1.0/24[0] proto=any dir=in"
                            Jan 29 18:03:20    racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP/Tunnel 63.252.x.x[0]->24.17.x.x[0] spi=258166286(0xf634e0e)
                            Jan 29 18:03:20    racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP/Tunnel 24.17.x.x[0]->63.252.x.x[0] spi=76670812(0x491e75c)
                            Jan 29 18:03:20    racoon: [Unknown Gateway/Dynamic]: INFO: Update the generated policy : 192.168.1.0/24[0] 172.16.1.0/24[0] proto=any dir=in
                            Jan 29 18:03:20    racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 2 negotiation: 63.252.x.x[0]<=>24.17.x.x[0]

                            1 Reply Last reply Reply Quote 0
                            • D
                              databeestje
                              last edited by

                              The error messages about policy's not already existing is not a error.

                              This is normal. This does not affect the operation the tunnel.

                              Kind regards,

                              Seth

                              1 Reply Last reply Reply Quote 0
                              • J
                                jle2005
                                last edited by

                                Thanks for letting me know that Seth.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.