IPSEC with multiple subnets

[brcisna]

Hello All,

pfSense 1.2.3 FinalRelease  X 2

Trying to get a handle on why on my site to site IPSEC tunnel,,I can ping all devices on the default 172.28.8.x subnet,at Site A ,,but devices that have static routes via pfSense box,,,can not be pinged from Site B.

Setup
Site A

Subnet(s):
172.28.8.x
172.28.10.x
172.28.12.x
172.28.14.x

Site B
192.168.1.x

From Site B any device on 172.28.8.x subnet ,( at Site A) can be pinged,,,but devices on any of the other three subnets can not be pinged,,,accessed.
I have tried using Wireshark,,but simply can not see were the packet(s) go to,,that fails on the failing subnets.

I am attaching the static route setup on Site A pfSense box.
It seems that as the devices are accessible on the LAN the static route table should feed out to the other subnets through the IPSEC setup as well?

Thank You,
Barry

[jason0]

Hi There!

The book has an answer, but it's not one I have tested, so take my advice with a grain of salt.

Section 13.4.3 talks about routing multiple subnets over ipsec.  In version 1.2.x, you are pretty much limited to building additional ipsec tunnels in parallel between the two sites for the different subnets.  In fact, there is a separate note saying that routing will have no effect at all on where the packets actually go, except for packets originating from the pfsense router itself.

The book also says that pfsense 2.x should be able to have multiple subnets specified within an ipsec tunnel.

–jason

[jimp]

You need multiple phase 2's for each possible combination, such as:

Client -> Server LAN
Client -> Server Static Route Net 1
Client -> Server Static Route Net 2
Client -> Server Static Route Net 3
[…]