IPSEC not working

jimp · Jun 6, 2009, 4:22 PM

I haven't tried parallel tunnels with 0.8 yet, but I can see why DPD might freak out.

Have you tried setting DPD to 0 for all tunnels?

ankaerith · Jun 8, 2009, 6:05 AM

I had unset DPD and it stopped the tunnels from being killed every interval. It did not help with parallel tunnels.

jimp · Jun 8, 2009, 11:18 AM

It looks like ipsec-tools is going to be backed down to 0.7.2 or so, with an added patch or two, instead of all the way up to 0.8. Not sure when those changes will happen though.

ankaerith · Jun 9, 2009, 12:35 AM

Well, for what it's worth, the issues I described in http://forum.pfsense.org/index.php/topic,14688.0.html were resolved in 1.2.3 w/ the 0.8 ipsec-tools. Of course, a lack of parallel tunnels is a rather big problem.

jimp · Jun 9, 2009, 12:39 AM

That is an issue that will be patched if it is reverted to 0.7.2.

The other person I heard of having trouble with 0.8 also turned out to be a parallel tunnel issue, so that does seem to be broken.

If we can get 0.7.2 patches so that DPD actually works properly, it will hopefully be stable and usable by everyone.

luma · Jun 15, 2009, 9:38 AM

As of the 1.2.3-RC2 built on Sun Jun 14 18:15:10 EDT 2009, parallel tunnel are working.

But I'm not using DPD so I cannot try. What's the status about this?

Thanks and regards

jimp · Jun 15, 2009, 9:59 PM

ipsec-tools was backed down to 0.7.2, but I have a patch in that should be helping DPD (or breaking it worse depending on which snapshot is in use). Parallel tunnels work fine with 0.7.2, so that's probably why it's working fine for you.

I'm waiting on a response from the ipsec-tools developers, hopefully they will have some insight.

luma · Jun 15, 2009, 10:14 PM

Thanks for your answer jimp.

I will try to do some testing with the next patch.

Keep the good job!

Papa Midnight · Jul 15, 2009, 2:35 PM

I've never gotten IPsec to work properly when going through pfSense. I even tried running it on a VM which worked fine if attempted internally, but try to do it through WAN and you can expect failure. Connections were subsequently denied, even with the proper ports opened.

heiko · Jul 16, 2009, 10:17 AM

with which version from PfSense?, 1.2 works and the latest 1.23 r2 snapshot works also. I have running 1.2 (carp cluster) with ipsec up and running and the uptime is 458 days….

regards
heiko

fastcon68 · Jul 17, 2009, 12:04 AM

I have been running IPSEC for over 2 years many flavors of PF-Sense no Issues. Except with the issue with one firmware update.
RC

cmb · Jul 17, 2009, 12:07 AM

@Papa:

I've never gotten IPsec to work properly when going through pfSense. I even tried running it on a VM which worked fine if attempted internally, but try to do it through WAN and you can expect failure. Connections were subsequently denied, even with the proper ports opened.

You're not doing something right. Start a new thread describing your problem.

The issue in this thread was the 0.8 ipsec-tools version we were testing, which is no longer a problem. Locking thread to prevent further hijacking, as nobody has the same issue as this thread covers.