Ipsec mobile clients in 2.0 not working?
-
from 1.2.3 or 2.0 ?
-
2.0
-
in files:
ipsec log in debug mode & /var/etc/racoon.conf & /var/etc/spd.conf & setkey -D & setkey -DP
files: 1.2.3 - worked
pfsense - only updated
pfsense updated + disable nat-tin all variants - client settings not changed
[1.2.3 -worked.txt](/public/imported_attachments/1/1.2.3 -worked.txt)
[pfsense - updated.txt](/public/imported_attachments/1/pfsense - updated.txt)
[disable nat-t on pfsense.txt](/public/imported_attachments/1/disable nat-t on pfsense.txt) -
jimp, I can send you the username \ password in PM for the client and pfsense
-
up
-
It's already a known issue and the solution will not be fast. Just keep an eye on the ticket for any updates.
-
Just keep an eye on the ticket for any updates.
tell me where to watch for updates? or them will be seen in the pfsese?
-
On the ticket. If any progress is made, someone will update that ticket.
-
jimp, can you clarify whether this is likely to be the same issue as this:
http://forum.pfsense.org/index.php/topic,41631.0.htmland if so, would the same information you asked for here be relevant? I would really like to help however possible to see this resolved.
Thanks.
-
in 2.0.1 not working & nat-t not working…
-
i was having problems with 2.0 and 2.1 for shrew ipsec clients where the initial connection would work fine, later subsequent connections would seem to connect but would fail to pass data
i tried disabling NAT-T and DPD as suggested elsewhere in this forum, but the ultimate fix was to setup the pfsense and shrew client per typical "road warrior" configs
e.g. http://dekapitein.vorkbaard.nl/tech-1/how-to-set-up-ipsec-tunneling-in-pfsense-2-0-release-for-road-warriors
with the EXCEPTION of setting the P1 Proposal Generation to "Unique" instead of "Default"
[that setting change is noted in the redmine link mentioned in this thread, but its in a slightly different context of multiple clients coming from the same nat network]
anyway, since making that change, i havent seen the problem where later reconnects fail, and no need to disable NAT-T and DPD
maybe that setting will work for you
