Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense 2.2 <-> pfSense 2.2 IPsec tunnel (RESOLVED)

    Scheduled Pinned Locked Moved IPsec
    13 Posts 6 Posters 4.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      Riccardo90
      last edited by

      Do you mean that you don't have a static public IP but is dynamic?.. in this case it should works also with the FQDN of DDNS.

      Riccardo

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        Where they were working before, they should work the same after the upgrade. What settings specifically do you have configured? What about it doesn't work? PM me if you can get me access.

        1 Reply Last reply Reply Quote 0
        • R
          ratch3t
          last edited by

          Settings for the tunnels are as follows…

          sc1.PNG
          sc1.PNG_thumb
          sc2.PNG
          sc2.PNG_thumb

          1 Reply Last reply Reply Quote 0
          • E
            eri--
            last edited by

            If you do not use the Gateway group does it work?

            1 Reply Last reply Reply Quote 0
            • R
              ratch3t
              last edited by

              Tried changing it to the CARP IP and just the WANPRI interface…  Still no go.

              1 Reply Last reply Reply Quote 0
              • R
                ratch3t
                last edited by

                Local side is looping this in the log:

                Jan 29 13:34:34 charon: 14[NET] 192: EC 42 7B 1F .B{.
                Jan 29 13:34:34 charon: 14[NET] 176: 00 00 00 14 90 CB 80 91 3E BB 69 6E 08 63 81 B5 ….....>.in.c..
                Jan 29 13:34:34 charon: 14[NET] 160: 4A 13 1C 81 07 03 58 45 5C 57 28 F2 0E 95 45 2F J…..XE\W(...E/
                Jan 29 13:34:34 charon: 14[NET] 144: 25 E7 DE 7F 00 D6 C2 D3 80 00 00 00 0D 00 00 14 %…............
                Jan 29 13:34:34 charon: 14[NET] 128: 74 CC 01 00 0D 00 00 18 40 48 B7 D5 6E BC E8 85 t…....@H..n...
                Jan 29 13:34:34 charon: 14[NET] 112: 0D 00 00 14 12 F5 F2 8C 45 71 68 A9 70 2D 9F E2 ….....Eqh.p-..
                Jan 29 13:34:34 charon: 14[NET] 96: AF CA D7 13 68 A1 F1 C9 6B 86 96 FC 77 57 01 00 ….h...k...wW..
                Jan 29 13:34:34 charon: 14[NET] 80: 0D 00 00 0C 09 00 26 89 DF D6 B7 12 0D 00 00 14 …...&.........
                Jan 29 13:34:34 charon: 14[NET] 64: 80 04 00 02 80 03 00 01 80 0B 00 01 80 0C 70 80 …...........p.
                Jan 29 13:34:34 charon: 14[NET] 48: 00 00 00 20 01 01 00 00 80 01 00 05 80 02 00 01 … ............
                Jan 29 13:34:34 charon: 14[NET] 32: 00 00 00 01 00 00 00 01 00 00 00 28 00 01 00 01 …........(....
                Jan 29 13:34:34 charon: 14[NET] 16: 01 10 02 00 00 00 00 00 00 00 00 C4 0D 00 00 34 …............4
                Jan 29 13:34:34 charon: 14[NET] 0: 5A 26 6C 38 44 63 66 42 00 00 00 00 00 00 00 00 Z&l8DcfB….....
                Jan 29 13:34:34 charon: 14[NET] received packet => 196 bytes @ 0x7ffffe1ee590
                Jan 29 13:34:34 charon: 14[NET] 192: EC 42 7B 1F .B{.
                Jan 29 13:34:34 charon: 14[NET] 176: 00 00 00 14 90 CB 80 91 3E BB 69 6E 08 63 81 B5 ….....>.in.c..
                Jan 29 13:34:34 charon: 14[NET] 160: 4A 13 1C 81 07 03 58 45 5C 57 28 F2 0E 95 45 2F J…..XE\W(...E/
                Jan 29 13:34:34 charon: 14[NET] 144: 25 E7 DE 7F 00 D6 C2 D3 80 00 00 00 0D 00 00 14 %…............
                Jan 29 13:34:34 charon: 14[NET] 128: 74 CC 01 00 0D 00 00 18 40 48 B7 D5 6E BC E8 85 t…....@H..n...
                Jan 29 13:34:34 charon: 14[NET] 112: 0D 00 00 14 12 F5 F2 8C 45 71 68 A9 70 2D 9F E2 ….....Eqh.p-..
                Jan 29 13:34:34 charon: 14[NET] 96: AF CA D7 13 68 A1 F1 C9 6B 86 96 FC 77 57 01 00 ….h...k...wW..
                Jan 29 13:34:34 charon: 14[NET] 80: 0D 00 00 0C 09 00 26 89 DF D6 B7 12 0D 00 00 14 …...&.........
                Jan 29 13:34:34 charon: 14[NET] 64: 80 04 00 02 80 03 00 01 80 0B 00 01 80 0C 70 80 …...........p.
                Jan 29 13:34:34 charon: 14[NET] 48: 00 00 00 20 01 01 00 00 80 01 00 05 80 02 00 01 … ............
                Jan 29 13:34:34 charon: 14[NET] 32: 00 00 00 01 00 00 00 01 00 00 00 28 00 01 00 01 …........(....
                Jan 29 13:34:34 charon: 14[NET] 16: 01 10 02 00 00 00 00 00 00 00 00 C4 0D 00 00 34 …............4
                Jan 29 13:34:34 charon: 14[NET] 0: 5A 26 6C 38 44 63 66 42 00 00 00 00 00 00 00 00 Z&l8DcfB….....
                Jan 29 13:34:34 charon: 14[NET] received packet => 196 bytes @ 0x7ffffe1ee590
                Jan 29 13:34:25 charon: 14[NET] waiting for data on sockets
                Jan 29 13:34:25 charon: 14[NET] waiting for data on sockets
                Jan 29 13:34:25 charon: 14[NET] received packet from –----[500] to –----[500] on ignored interface
                Jan 29 13:34:25 charon: 14[NET] received packet from –----[500] to –----[500] on ignored interface
                Jan 29 13:34:25 charon: 14[NET] received packet: from –----[500] to –---[500]
                Jan 29 13:34:25 charon: 14[NET] received packet: from –----[500] to –---[500]

                REMOTE SIDE is showing this:
                Jan 29 13:37:01 charon: 09[KNL] SADB_EXT_PROPOSAL
                Jan 29 13:37:01 charon: 09[KNL] SADB_EXT_PROPOSAL
                Jan 29 13:37:01 charon: 09[KNL] SADB_X_EXT_POLICY
                Jan 29 13:37:01 charon: 09[KNL] SADB_X_EXT_POLICY
                Jan 29 13:37:01 charon: 09[KNL] SADB_EXT_ADDRESS_DST
                Jan 29 13:37:01 charon: 09[KNL] SADB_EXT_ADDRESS_DST
                Jan 29 13:37:01 charon: 09[KNL] SADB_EXT_ADDRESS_SRC
                Jan 29 13:37:01 charon: 09[KNL] SADB_EXT_ADDRESS_SRC
                Jan 29 13:37:01 charon: 09[KNL] received an SADB_ACQUIRE
                Jan 29 13:37:01 charon: 09[KNL] received an SADB_ACQUIRE
                Jan 29 13:37:01 charon: 06[JOB] watcher going to select()
                Jan 29 13:37:01 charon: 06[JOB] watcher going to select()
                Jan 29 13:37:01 charon: 06[JOB] watching 22 for reading
                Jan 29 13:37:01 charon: 06[JOB] watching 22 for reading
                Jan 29 13:37:01 charon: 06[JOB] watching 17 for reading
                Jan 29 13:37:01 charon: 06[JOB] watching 17 for reading
                Jan 29 13:37:01 charon: 06[JOB] watching 10 for reading
                Jan 29 13:37:01 charon: 06[JOB] watching 10 for reading
                Jan 29 13:37:01 charon: 06[JOB] watched FD 12 ready to read
                Jan 29 13:37:01 charon: 06[JOB] watched FD 12 ready to read
                Jan 29 13:36:33 charon: 09[MGR] check-in of IKE_SA successful.
                Jan 29 13:36:33 charon: 09[MGR] <con1000|3381>check-in of IKE_SA successful.
                Jan 29 13:36:33 charon: 03[JOB] next event in 41s 989ms, waiting
                Jan 29 13:36:33 charon: 03[JOB] next event in 41s 989ms, waiting
                Jan 29 13:36:33 charon: 08[NET] sending packet: from –----[500] to –----[500]
                Jan 29 13:36:33 charon: 08[NET] sending packet: from –----[500] to –----[500]
                Jan 29 13:36:33 charon: 09[MGR] checkin IKE_SA con1000[3381]
                Jan 29 13:36:33 charon: 09[MGR] <con1000|3381>checkin IKE_SA con1000[3381]
                Jan 29 13:36:33 charon: 09[NET] sending packet: from –-----[500] to –-----[500] (196 bytes)
                Jan 29 13:36:33 charon: 09[NET] <con1000|3381>sending packet: from –----[500] to –---[500] (196 bytes)
                Jan 29 13:36:33 charon: 09[IKE] sending retransmit 4 of request message ID 0, seq 1
                Jan 29 13:36:33 charon: 09[IKE] <con1000|3381>sending retransmit 4 of request message ID 0, seq 1
                Jan 29 13:36:33 charon: 09[MGR] IKE_SA con1000[3381] successfully checked out
                Jan 29 13:36:33 charon: 09[MGR] IKE_SA con1000[3381] successfully checked out
                Jan 29 13:36:33 charon: 09[MGR] checkout IKE_SA
                Jan 29 13:36:33 charon: 09[MGR] checkout IKE_SA
                Jan 29 13:36:33 charon: 03[JOB] no events, waiting
                Jan 29 13:36:33 charon: 03[JOB] no events, waiting
                Jan 29 13:36:33 charon: 03[JOB] got event, queuing job for execution
                Jan 29 13:36:33 charon: 03[JOB] got event, queuing job for execution
                Jan 29 13:36:29 charon: 06[JOB] watcher going to select()
                Jan 29 13:36:29 charon: 06[JOB] watcher going to select()
                Jan 29 13:36:29 charon: 06[JOB] watching 22 for reading
                Jan 29 13:36:29 charon: 06[JOB] watching 22 for reading
                Jan 29 13:36:29 charon: 06[JOB] watching 17 for reading
                Jan 29 13:36:29 charon: 06[JOB] watching 17 for reading
                Jan 29 13:36:29 charon: 06[JOB] watching 12 for reading
                Jan 29 13:36:29 charon: 06[JOB] watching 12 for reading
                Jan 29 13:36:29 charon: 06[JOB] watching 10 for reading
                Jan 29 13:36:29 charon: 06[JOB] watching 10 for reading
                Jan 29 13:36:29 charon: 09[CFG] ignoring acquire, connection attempt pending
                Jan 29 13:36:29 charon: 09[CFG] ignoring acquire, connection attempt pending
                Jan 29 13:36:29 charon: 06[JOB] watcher got notification, rebuilding
                Jan 29 13:36:29 charon: 06[JOB] watcher got notification, rebuilding
                Jan 29 13:36:29 charon: 02[KNL] creating acquire job for policy –----/32|/0 === -------/32|/0 with reqid {1}
                Jan 29 13:36:29 charon: 02[KNL] creating acquire job for policy –----/32|/0 === -------/32|/0 with reqid {1}</con1000|3381></con1000|3381></con1000|3381></con1000|3381>

                1 Reply Last reply Reply Quote 0
                • E
                  eri--
                  last edited by 

                  
an 29 13:34:25   charon: 14[NET] received packet from ------[500] to ------[500] on ignored interface
Jan 29 13:34:25   charon: 14[NET] received packet from ------[500] to ------[500] on ignored interface
Jan 29 13:34:25   charon: 14[NET] received packet: from ------[500] to -----[500]
Jan 29 13:34:25   charon: 14[NET] received packet: from ------[500] to -----[500]

                  I think you have a routing issue of sorts not related to pfSense.

                  1 Reply Last reply Reply Quote 0
                  • C
                    cmb
                    last edited by

                    This one just ended up being mismatched IPs in the P1. It appears it was compounded by some circumstance in which if you make significant changes to the IPsec config, strongswan wants a full stop/start to properly apply that. I'm looking into that issue separately.

                    1 Reply Last reply Reply Quote 0
                    • T
                      Thale
                      last edited by

                      @cmb:

                      It appears it was compounded by some circumstance in which if you make significant changes to the IPsec config, strongswan wants a full stop/start to properly apply that. I'm looking into that issue separately.

                      Would "Restart Service" work, or does a "full stop/start" refer to an actual stop followed by a start?

                      1 Reply Last reply Reply Quote 0
                      • C
                        cmb
                        last edited by

                        @Thale:

                        Would "Restart Service" work, or does a "full stop/start" refer to an actual stop followed by a start?

                        Stop it, then start it. A restart in some cases apparently doesn't apply all the config file changes that were made in some circumstance(s) I haven't fully quantified yet.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.