Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [2.2] Mobile clients not connecting anymore

    Scheduled Pinned Locked Moved IPsec
    41 Posts 16 Posters 16.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • maxxerM
      maxxer
      last edited by

      @cmb:

      That's not true and not relevant here, given Ubuntu machines work and just Android doesn't.

      Indeed this puzzled me… This is a portion of the log, I hope I got the correct lines since I have other vpns running:

      Jan 29 09:01:40 pfyo charon: 07[NET] received packet: from ANDROIDIP[61809] to PFSENSEIP[500] (656 bytes)
Jan 29 09:01:40 pfyo charon: 07[ENC] parsed AGGRESSIVE request 0 [ SA KE No ID V V V V V V V V ]
Jan 29 09:01:40 pfyo charon: 07[IKE] <9397> received FRAGMENTATION vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] received FRAGMENTATION vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] <9397> received NAT-T (RFC 3947) vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] received NAT-T (RFC 3947) vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] <9397> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] <9397> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] <9397> received draft-ietf-ipsec-nat-t-ike-00 vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] <9397> received XAuth vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] received XAuth vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] <9397> received Cisco Unity vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] received Cisco Unity vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] <9397> received DPD vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] received DPD vendor ID
Jan 29 09:01:40 pfyo charon: 07[IKE] <9397> ANDROIDIP is initiating a Aggressive Mode IKE_SA
Jan 29 09:01:40 pfyo charon: 07[IKE] ANDROIDIP is initiating a Aggressive Mode IKE_SA
Jan 29 09:01:40 pfyo charon: 07[CFG] looking for XAuthInitPSK peer configs matching PFSENSEIP...ANDROIDIP[vpnusers@domain.com]
Jan 29 09:01:40 pfyo charon: 07[CFG] selected peer config "con4"
Jan 29 09:01:40 pfyo charon: 07[ENC] generating AGGRESSIVE response 0 [ SA KE No ID NAT-D NAT-D HASH V V V V V ]
Jan 29 09:01:40 pfyo charon: 07[NET] sending packet: from PFSENSEIP[500] to ANDROIDIP[61809] (432 bytes)
Jan 29 09:01:43 pfyo charon: 07[NET] received packet: from ANDROIDIP[61809] to PFSENSEIP[500] (656 bytes)
Jan 29 09:01:43 pfyo charon: 07[IKE] <con4|9397>received retransmit of request with ID 0, retransmitting response
Jan 29 09:01:43 pfyo charon: 07[IKE] received retransmit of request with ID 0, retransmitting response
Jan 29 09:01:43 pfyo charon: 07[NET] sending packet: from PFSENSEIP[500] to ANDROIDIP[61809] (432 bytes)
Jan 29 09:01:44 pfyo charon: 07[IKE] <con4|9397>sending retransmit 1 of response message ID 0, seq 1
Jan 29 09:01:44 pfyo charon: 07[IKE] sending retransmit 1 of response message ID 0, seq 1
Jan 29 09:01:44 pfyo charon: 07[NET] sending packet: from PFSENSEIP[500] to ANDROIDIP[61809] (432 bytes)
Jan 29 09:01:45 pfyo charon: 07[IKE] <con1000|8701>sending DPD request
Jan 29 09:01:45 pfyo charon: 07[IKE] sending DPD request
Jan 29 09:01:45 pfyo charon: 07[ENC] generating INFORMATIONAL_V1 request 3656135092 [ HASH N(DPD) ]
Jan 29 09:01:46 pfyo charon: 07[ENC] parsed INFORMATIONAL_V1 request 2519074927 [ HASH N(DPD_ACK) ]
Jan 29 09:01:46 pfyo charon: 07[NET] received packet: from ANDROIDIP[61809] to PFSENSEIP[500] (656 bytes)
Jan 29 09:01:46 pfyo charon: 07[IKE] <con4|9397>received retransmit of request with ID 0, retransmitting response
Jan 29 09:01:46 pfyo charon: 07[IKE] received retransmit of request with ID 0, retransmitting response
Jan 29 09:01:46 pfyo charon: 07[NET] sending packet: from PFSENSEIP[500] to ANDROIDIP[61809] (432 bytes)
Jan 29 09:01:48 pfyo charon: 07[IKE] <con1000|8701>unable to reauthenticate in CHILD_SA REKEYING state, delaying for 18s
Jan 29 09:01:48 pfyo charon: 07[IKE] unable to reauthenticate in CHILD_SA REKEYING state, delaying for 18s
Jan 29 09:01:48 pfyo charon: 07[NET] received packet: from ANOTHERIP[500] to PFSENSEIP[500] (92 bytes)
Jan 29 09:01:48 pfyo charon: 07[ENC] parsed INFORMATIONAL_V1 request 2836642412 [ HASH N(DPD) ]
Jan 29 09:01:48 pfyo charon: 07[ENC] generating INFORMATIONAL_V1 request 2010749931 [ HASH N(DPD_ACK) ]
Jan 29 09:01:48 pfyo charon: 07[NET] sending packet: from PFSENSEIP[500] to ANOTHERIP[500] (92 bytes)
Jan 29 09:01:49 pfyo charon: 07[IKE] <con2000|8801>sending DPD request
Jan 29 09:01:49 pfyo charon: 07[IKE] sending DPD request
Jan 29 09:01:49 pfyo charon: 07[ENC] generating INFORMATIONAL_V1 request 3608059943 [ HASH N(DPD) ]</con2000|8801></con1000|8701></con4|9397></con1000|8701></con4|9397></con4|9397>
      1 Reply Last reply Reply Quote 0
      • maxxerM
        maxxer
        last edited by

        no ideas? anyone else using mobile IPSec on 2.2? thanks

        1 Reply Last reply Reply Quote 0
        • D
          dharrigan
          last edited by

          Hi,

          Just to add my voice to this, my iOS devices connect successfully, as do my Mac clients.

          Android just fails to connect.

          Same setup from pfSense 2.1, but on pfSense 2.2, Android devices just fail (sidenote, I wish I could see logs on Android of the connection/failure so I can at least try and figure out what Android is doing…)

          -=david=-

          1 Reply Last reply Reply Quote 0
          • E
            eri--
            last edited by 

            
Jan 29 09:01:46 pfyo charon: 07[NET] received packet: from ANDROIDIP[61809] to PFSENSEIP[500] (656 bytes)

            Seeing this there seems a device doing nat in front of the Android device and changing ports which do not make ipsec happy in general.
            Without having full details its a bit of a problem to diagnostic.

            1 Reply Last reply Reply Quote 0
            • maxxerM
              maxxer
              last edited by

              @ermal:

              Seeing this there seems a device doing nat in front of the Android device and changing ports which do not make ipsec happy in general.
              Without having full details its a bit of a problem to diagnostic.

              Well, most of my Android VPN connections come from a NATted connection (i.e. when I'm at home connected to my wifi), and it has been working fine in 2.1.
              What full detail do you need? I'll try to provide them.

              1 Reply Last reply Reply Quote 0
              • H
                HaburGate
                last edited by

                @maxxer:

                no ideas? anyone else using mobile IPSec on 2.2? thanks

                Having the same problem here, mobile devices (iPhone, iPad and Android) can't connect after 2.2 upgrade.

                PGP Key: 0x82A211A2
                Server:    pool.sks-keyservers.net

                1 Reply Last reply Reply Quote 0
                • C
                  covex
                  last edited by

                  i can't ipsec into pfsense 2.2 box from iphone anymore. used to work on 2.1.3

                  1 Reply Last reply Reply Quote 0
                  • J
                    jalonergan
                    last edited by

                    I am having the same issues with IPSEC and 2.2. Most of the Pfsense online guides are for versions less than 2.1.5. Does anyone have a step by step guide that they can post for a verified working configuration utilizing PSEC on 2.2 with Shrew Client and Android 4.4 as the clients. Thanks!

                    Joe

                    1 Reply Last reply Reply Quote 0
                    • E
                      eri--
                      last edited by

                      Please provide the logs to analyze this.
                      Also read the RELEASE notes about the new update and changes with things to conisder.

                      1 Reply Last reply Reply Quote 0
                      • P
                        pinoyboy
                        last edited by

                        Moved…

                        1 Reply Last reply Reply Quote 0
                        • E
                          eri--
                          last edited by

                          Please open a new thread for your issue but probably its related that you need on pfSense side to set the phase2 to 0.0.0.0/0 for the client.
                          It is on the release notes.

                          1 Reply Last reply Reply Quote 0
                          • H
                            HaburGate
                            last edited by

                            @ermal:

                            Please open a new thread for your issue but probably its related that you need on pfSense side to set the phase2 to 0.0.0.0/0 for the client.
                            It is on the release notes.

                            Is this under the Local Network field? Currently I have it set to "LAN Subnet."

                            PGP Key: 0x82A211A2
                            Server:    pool.sks-keyservers.net

                            1 Reply Last reply Reply Quote 0
                            • maxxerM
                              maxxer
                              last edited by

                              I managed to install a fresh new 2.2, configure using this howto, and captured this log. I hope this can help debug.
                              Let me know if you need further debugging.
                              thanks for the help.

                              1 Reply Last reply Reply Quote 0
                              • maxxerM
                                maxxer
                                last edited by

                                I made some searches and tests myself.
                                First I found a possible issue with missing leftsendcert=always, but doesn't seem to apply to this problem.
                                Then I found an old thread about android and 2.2, and that seem to matter!

                                I had to do two changes:

                                • on the server set IPSec mobile to main mode

                                • on the Android client remove the IPSec identifier field (leave blank)

                                This way the VPN connection is established.
                                Can anyone else please confirm?

                                Sadly this way I have a regression: Ubuntu client won't connect anymore, it seems it's starting an aggressive mode connection thus fails…

                                1 Reply Last reply Reply Quote 0
                                • H
                                  HaburGate
                                  last edited by

                                  Hi Maxxer, can you post a screenshot of your Phase 1 and Phase 2 screens? (with applicable info blacked out). Fighting the same issue here, trying to get Android and iPhone clients connected.

                                  PGP Key: 0x82A211A2
                                  Server:    pool.sks-keyservers.net

                                  1 Reply Last reply Reply Quote 0
                                  • maxxerM
                                    maxxer
                                    last edited by

                                    @vocatus:

                                    Hi Maxxer, can you post a screenshot of your Phase 1 and Phase 2 screens? (with applicable info blacked out). Fighting the same issue here, trying to get Android and iPhone clients connected.

                                    attaching here a working configuration for Android. Tested just with one device running Lollipop. NOT working with Ubuntu (seems it doesn't like main mode, just aggressive).
                                    IKE mode works both in auto, v1 or v2. Just make sure to leave blank group identifier on the phone configuration.

                                    ipsecphase1.png
                                    ipsecphase2.png
                                    ipsecphase1.png_thumb
                                    ipsecphase2.png_thumb

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      sserg18
                                      last edited by

                                      here is my config. works on mac os, ios 7.1.1, ios 8.0. cisco ipsec vpn

                                      ipsec10s.jpg
                                      ipsec-6s.jpg
                                      ipsec-4s.jpg
                                      ipsec-3s.jpg
                                      ipsec-2s.jpg
                                      ipsec-2s.jpg_thumb
                                      ipsec-3s.jpg_thumb
                                      ipsec-4s.jpg_thumb
                                      ipsec-6s.jpg_thumb
                                      ipsec10s.jpg_thumb

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        sserg18
                                        last edited by

                                        @maxxer:

                                        @vocatus:

                                        Hi Maxxer, can you post a screenshot of your Phase 1 and Phase 2 screens? (with applicable info blacked out). Fighting the same issue here, trying to get Android and iPhone clients connected.

                                        attaching here a working configuration for Android. Tested just with one device running Lollipop. NOT working with Ubuntu (seems it doesn't like main mode, just aggressive).
                                        IKE mode works both in auto, v1 or v2. Just make sure to leave blank group identifier on the phone configuration.

                                        if we make Key Exchange version = auto
                                        then Negotiation mode - switches from agressive, mode main.

                                        In this case mac os ios not work.

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          Phoenix
                                          last edited by

                                          @maxxer:

                                          I had to do two changes:

                                          • on the server set IPSec mobile to main mode

                                          • on the Android client remove the IPSec identifier field (leave blank)

                                          Some time ago, I stumbled upon, that leaving the IPSec identifier blank android will initiate with main mode, having something in this field will switch it to aggressive mode. This still applies for android 5.0

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            dharrigan
                                            last edited by

                                            Hi,

                                            I can confirm too that by setting mode to main and removing the ipsec identifier, I'm able to connect to my VPN again using Android with Lollipop.

                                            So, is this a bug with Android and nothing we can do on pfSense, or is this something that we can fix on pfSense?

                                            Now then, will this configuration work for iOS….. :-)

                                            -=david=-

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.