Ipsec mobile clients in 2.0 not working?

jimp

We have an idea - it's a known issue - but no leads on a fix.

We have all the info we need already from others, but the info we really need (if you want to provide more) is the contents of:

/var/etc/racoon.conf
/var/etc/spd.conf

And the output of:
setkey -D
setkey -DP

And the IPs involved at the connection at the time, plus the ipsec log details (it's probably just saying it can't locate an SA, even though it looks like one exists)

alexandrnew

from 1.2.3 or 2.0 ?

jimp

2.0

alexandrnew

in files:
ipsec log in debug mode & /var/etc/racoon.conf & /var/etc/spd.conf & setkey -D & setkey -DP
files: 1.2.3 - worked
pfsense - only updated
pfsense updated + disable nat-t

in all variants - client settings not changed

[1.2.3 -worked.txt](/public/imported_attachments/1/1.2.3 -worked.txt)
[pfsense - updated.txt](/public/imported_attachments/1/pfsense - updated.txt)
[disable nat-t on pfsense.txt](/public/imported_attachments/1/disable nat-t on pfsense.txt)

alexandrnew

jimp, I can send you the username \ password in PM for the client and pfsense

alexandrnew

up

jimp

It's already a known issue and the solution will not be fast. Just keep an eye on the ticket for any updates.

alexandrnew

@jimp:

Just keep an eye on the ticket for any updates.

tell me where to watch for updates? or them will be seen in the pfsese?

jimp

On the ticket. If any progress is made, someone will update that ticket.

limecat

jimp, can you clarify whether this is likely to be the same issue as this:
http://forum.pfsense.org/index.php/topic,41631.0.html

and if so, would the same information you asked for here be relevant? I would really like to help however possible to see this resolved.

Thanks.

alexandrnew

in 2.0.1 not working & nat-t not working…

boogieshafer

i was having problems with 2.0 and 2.1 for shrew ipsec clients where the initial connection would work fine, later subsequent connections would seem to connect but would fail to pass data

i tried disabling NAT-T and DPD as suggested elsewhere in this forum, but the ultimate fix was to setup the pfsense and shrew client per typical "road warrior" configs

e.g. http://dekapitein.vorkbaard.nl/tech-1/how-to-set-up-ipsec-tunneling-in-pfsense-2-0-release-for-road-warriors

with the EXCEPTION of setting the P1 Proposal Generation to "Unique" instead of "Default"

[that setting change is noted in the redmine link mentioned in this thread, but its in a slightly different context of multiple clients coming from the same nat network]

anyway, since making that change, i havent seen the problem where later reconnects fail, and no need to disable NAT-T and DPD

maybe that setting will work for you