Phase 1 up or unstable?
-
I'm trying to establish a site to site IPSec tunnel between two pfSense boxes. The tunnel's not up, but being new to this, I'm not sure if it's a phase 1 or phase 2 issue. My log looks like this…
Jul 14 15:42:44 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=222517895(0xd435a87)
Jul 14 15:42:44 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=235052421(0xe029d85)
Jul 14 15:42:51 racoon: [SiteB]: INFO: initiate new phase 2 negotiation: aaa.aaa.aaa.aaa[500]<=>bbb.bbb.bbb.bbb[500]
Jul 14 15:42:51 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=87610327(0x538d3d7)
Jul 14 15:42:51 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=202571367(0xc12fe67)
Jul 14 15:43:13 racoon: [SiteB]: INFO: initiate new phase 2 negotiation: aaa.aaa.aaa.aaa[500]<=>bbb.bbb.bbb.bbb[500]
Jul 14 15:43:13 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=226876164(0xd85db04)
Jul 14 15:43:13 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=186685903(0xb2099cf)and it keeps repeating. It looks like phase 1 is completing but phase 2 keeps initiating. I'm not sure if that's because phase 1 is not staying up or because phase 2 can't establish. I'm not sure where to look from here. Can anyone point me in the right direction?
Thanks.
-
On a whim, I changed Policy Generation and Proposal Checking to Default and Encryption to Blowfish on both sides. Tunnel's now showing up, but traffic's not routing. I have an IPSec F/W rule allowing any/any on both F/Ws. If I'm not mistaken, the Local Network and Remote Network fields on the IPSec Phase 2 configuration create a routing table so that if I try to access addresses on Site B from Site A (and my pfSense is my default gateway), it knows to route the traffic through the tunnel, right? Should I expect to be able to reach my pfSense on Site B from Site A using the IP address of the LAN Interface? I can when I VPN client to site, but not site to site.
Thoughts?