VPN between two 2.2.1 (alix and esxi based) - Not stable

nikolaii

Hello,

I have some stability problems with many IPSec tunnels I have from my central ESXi gateway (which has multiple phase2 tunnels).

What happen is that the tunnels comes up, but then no traffic can be exchanged inside, and when I look in the IPSec status page, I can see a loooot of phase2 duplicates. So I read the forum, and I did add a custom key like https://forum.pfsense.org/index.php?topic=91627.0 suggests.

net.key.preferred_oldsa = 0

Today I restarted the central gateway and the tunnels were working nice again … but for how long?

I came across a log message which I cannot explain, which could be related to my problems?

Jun 19 09:20:48 	charon: 03[CFG] trap not found, unable to acquire reqid 19833
Jun 19 09:20:48 	charon: 03[KNL] creating acquire job for policy A.B.C.D/32|/0 === E.F.G.H/32|/0 with reqid {19833}

This is what I got when I was trying to ping the other end after having reset the IPSec tunnel through the "IPSec Status" page.

I'd like to debug this and have more stable tunnels, but so far I can't find what to do … Any help is much appreciated.

doktornotor

Grab the latest 2.2.3 snapshot for any and all IPsec usage. Debugging known-to-be superbuggy 2.2.1's IPsec is a pure waste of time.

nikolaii

Thank you for your answer.

Since these are production firewalls, I don't fancy installing a beta or RC.

But I could install a 2.1.5 or 2.2.2 release. What do you think would be my best option (besides waiting for the 2.2.3 to become a stable release)?

doktornotor

https://doc.pfsense.org/index.php/2.2.2_New_Features_and_Changes#IPsec
https://doc.pfsense.org/index.php/2.2.3_New_Features_and_Changes#IPsec

Not really sure what else to suggest here. The older 2.2 version, the more buggy IPsec.

nikolaii

Well I'll wait till 2.2.3 is released as a stable version then :)