No traffic, tunnels in the green
-
Got the connection to come back up but now on my firewall with the ip address 192.168.0.0/24 I'm getting….....
Oct 28 04:55:29 racoon: ERROR: couldn't find configuration.
Oct 28 04:55:19 last message repeated 3 times
Oct 28 04:54:49 racoon: ERROR: couldn't find configuration. -
Traffic is showing up on 10.0.0.1/24 coming from 192.168.0.1/24 through enc0 but not returning
-
Nothing?
-
have you done any packet captures lately? I'd start capturing packets to see if they are arriving and not being returned or if they are not even arriving. Could the devices on one side of the tunnel have a different gateway that doesn't know about the route to the tunnel?
-
OK, IPSec sucks, that's all there is to it, down with IPSec
-
Having the same basic problem myself, tunnels are up, but pings won't go through and am unable to load up web interface for pfsense2 from pfsense1. I checked the packet capture for the pinging and it shows the ping coming in and being sent back out but pfsense1 never receives the pings. I have IMCP traffic allowed, AH traffic allowed, and all traffic allowed on lan/wan/ipsec firewall tabs…..
-
Having the same basic problem myself, tunnels are up, but pings won't go through and am unable to load up web interface for pfsense2 from pfsense1. I checked the packet capture for the pinging and it shows the ping coming in and being sent back out but pfsense1 never receives the pings. I have IMCP traffic allowed, AH traffic allowed, and all traffic allowed on lan/wan/ipsec firewall tabs…..
I can add myself to this thread as well having the same symptoms as the individuals above. IPsec tunnels are presenting as connected but no traffic passes through, funny thnig is that the firewall log shows the traffic as "passed" even though nothing is actually going through.
These symptoms present themselves on both 1.2.2 and 1.2.3-rc3 releases. And to add a little bit more spice to the whole story i can connect fully to the LAN interface of the remote pfsense box just fine (attachments show 10.2.1.222 which is the LAN IP of the aforementioned pfsense box).
Telnet attempt to the local IP address of that remote subnet running nagios on the port 12489:
This is how it looks in the pfsense log:
Another SS of the CLI:
ICMP passed ?:
-
Hello,
Please disregard my last post, clearly a PEBKAC problem (someone from the tech. dept. added a static route on all servers to the inexistent gateway … ah joy !).
-
You may also try to check "Prefer old IPsec SAs" under Advanced options.
I had a tunnel today to a different device (watchguard firebox) that was not stable (would just stop passing traffic, if it did at all) without that setting turned on.
-
Ok, I've narrowed down my problem to the AH/ESP settings…. If I use AH the tunnel connects but no traffic goes through, however, if I use ESP the tunnel connects and traffice goes through with no trouble. The problem here being, I have to use AH because we have to not only connect to our own routers but also to a 3rd party router which uses the the AH setting..... Any ideas on how to fix this?
-
AH traffic is not encrypted, only authenticated. I would fix the device that supposedly requires AH, as otherwise you're sending all of this traffic with no protection.
-
Unfortunately we can't dictate to the 3rd party how they should set up their VPN tunnel, they get to dictate to us what we have to set up in order to connect to them.
-
htgtech
You do know that you need to set up separate tunnels, right? The tunnels to your routers could have the ESP setting and the tunnel to the third party could use AH. I apologize if this answer is beneath you. I don't know anyone's experience level. -
I realize the need for seperate tunnels, as I have 5 tunnels already set up on the main router to go to the other routers. However, the problem still remains that the AH protocol is not allowing traffic which would still be an issue on the other tunnel to the 3rd party. Unless the problem is only with 2 pfsense routers trying to use AH.
-
I just realized something. I am getting traffic from 192.168.0.0 to 10.0.0.0 but not from 10.0.0.0 to 192.168.0.0 which is how I want it. How can I change the order so that traffic from 10.0.0.0 can get to 192.168.0.0. If I can get that traffic to flow then what I am trying to connect to should work as I can ping from 192.168.0.0 but not from 10.0.0.0
-
I also just noticed that I'm getting a sendfromto failed error on 192.168.0.0
" racoon: ERROR: sendfromto failed"
-
Well in new news I setup a tunnel between me and another local location and it was working fine then went down. I brought the tunnels back up but again I can't get traffic through the tunnels.
-
Well in new news I setup a tunnel between me and another local location and it was working fine then went down. I brought the tunnels back up but again I can't get traffic through the tunnels.
Can I ask what version you have at both locations?
