Phase2 negotiation failed due to time up waiting for phase1 [Remote Side not res

craigduff

Guys,

Hello! I am just trying to setup a pfsense 2.0.1 to pfsense 2.0.1 VPN connection! should be really easy to answer im sure. Here are my logs? What do you suggest?

Jan 25 16:44:53

racoon: []: [IP ADDRESS] ERROR: phase2 negotiation failed due to time up waiting for phase1 [Remote Side not responding]. ESP IP ADDRESS [0]->IP ADDRESS[0]

Jan 25 16:44:53
racoon: INFO: delete phase 2 handler.

Jan 25 16:45:11
racoon: ERROR: phase1 negotiation failed due to time up. a2e27b79526032cf:0000000000000000

craigduff

Both logs at either end say the same thing. Remote side not responding. What am i doing wrong?

maldex

not much to say, "phase1 Remote Side not responding" means that the initial connection to the remote gw failed. Check your configuration and make sure you did the criss-cross the right way around? there are also some pretty good howtos to configure.

cmb

Means you don't have bidirectional connectivity for UDP 500 and/or ESP between those hosts, maybe something upstream of them filtering, amongst other possibilities. Packet capture on WAN of each side filtering on the remote side's IP would be telling.

craigduff

Now this is interesting because i have purchased 2 servers with OVH and i am trying to connect them together. The VPN to my house and my other house works just fine. but when trying to connect 2 OVH servers they are getting that error. Its interesting. Thank you for the heads up. So could well be a routing issue.

I can tell you when im on either phsical server on a virtul server. I can access the external IP address to get into the firewalls, if that makes sense?

craigduff

Just tried changing the public IP address and be on a different Virtual WAN Network Card.

Jan 26 12:19:26
racoon: INFO: unsupported PF_KEY message REGISTER

Jan 26 12:19:26
racoon: [Unknown Gateway/Dynamic]: ERROR: such policy already exists. anyway replace it: 10.49.97.0/24[0] 10.99.69.0/24[0] proto=any dir=in

Jan 26 12:19:26
racoon: [Unknown Gateway/Dynamic]: ERROR: such policy already exists. anyway replace it: 10.99.69.0/24[0] 10.49.97.0/24[0] proto=any dir=out

pingulino

@craigduff:

Jan 26 12:19:26
racoon: INFO: unsupported PF_KEY message REGISTER

Jan 26 12:19:26
racoon: [Unknown Gateway/Dynamic]: ERROR: such policy already exists. anyway replace it: 10.49.97.0/24[0] 10.99.69.0/24[0] proto=any dir=in

Those are not real errors, just notifications.

Now I don't know if you still have problems, if so I just want to tell what worked for me:
Some characters can not be used for the psk, '+' doesn't work also others but don't know for sure which.
I use only letters and numbers now, my problem solved.

cmb

@pingulino:

Some characters can not be used for the psk, '+' doesn't work also others but don't know for sure which.
I use only letters and numbers now, my problem solved.

That's not true on pfsense at least, it may be true on other devices in some circumstances.

craigduff

Guys this is the response i was after.

OVH Failover IPs are protected against UDP attacks, this disturbs some VPN and other UDP protocols.
You can buy unprotected IP from your OVH Manager, search 'IP for UDP' or something, close to your "IP Failover" Icon.
I tried on my own kimsufi, but I don't have enabled the "professional use", then I cannot try it