Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec Down after Upgrade to 2.3

    IPsec
    30
    72
    39.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      shthead
      last edited by

      Unfortunately I need OpenBGPD as I advertise prefixes that need to be routed over the IPSEC tunnels to the pfSense server. Its both too hard to keep track of which prefixes go where and much easier from a failover/traffic engineering point of view to not use it for my case. In this particular situation I also advertise the prefixes in the local office network to the pfSense server from the switches as there are quite a few different networks. I hope that there is a work around at some point, I would be happy to be a guinea pig for it.

      1 Reply Last reply Reply Quote 0
      • F
        fattylewis
        last edited by

        @shthead:

        Unfortunately I need OpenBGPD as I advertise prefixes that need to be routed over the IPSEC tunnels to the pfSense server. Its both too hard to keep track of which prefixes go where and much easier from a failover/traffic engineering point of view to not use it for my case. In this particular situation I also advertise the prefixes in the local office network to the pfSense server from the switches as there are quite a few different networks. I hope that there is a work around at some point, I would be happy to be a guinea pig for it.

        This is exactly why i am so glad i updated my home system before doing my office router…

        I guess best you can do is see what cmb says :(

        1 Reply Last reply Reply Quote 0
        • J
          jjb-123
          last edited by

          Hello!

          We have the same problem, applied the patch, however as we use OpenBGPD for AWS, ALL the IPSEC vpn's drop.

          The only way we fix it at the moment is to reboot the Firewall (this is not ideal).

          Any suggestions?

          Thanks

          1 Reply Last reply Reply Quote 0
          • V
            vsxi-13
            last edited by

            Running into what appears to be the same issue.  I've installed the patch that CMB put up and I'm testing it out.  I don't IPsec a lot, but I'll see about trying to do some more in the next couple days to see if this remains fixed.  Luckily I have an OpenVPN connection that I use for other services that I can get back in and stop/start the IPSec service.  Below is a sanitized version of the error message:

            
Apr 18 17:03:02	charon		07[NET] <328> received packet: from x.x.x.x[63521] to y.y.y.y[500] (300 bytes)
Apr 18 17:03:02	charon		07[ENC] <328> parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
Apr 18 17:03:02	charon		07[IKE] <328> x.x.x.x is initiating an IKE_SA
Apr 18 17:03:02	charon		07[IKE] <328> remote host is behind NAT
Apr 18 17:03:02	charon		07[IKE] <328> sending cert request for "C=US, ST=Wisconsin, L=Madison, O=Xinu, E=zach@xinu.io, CN=dd13-CA"
Apr 18 17:03:02	charon		07[ENC] <328> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(MULT_AUTH) ]
Apr 18 17:03:02	charon		07[NET] <328> sending packet: from y.y.y.y[500] to x.x.x.x[63521] (341 bytes)
Apr 18 17:03:02	charon		07[NET] <328> received packet: from x.x.x.x[4244] to y.y.y.y[4500] (332 bytes)
Apr 18 17:03:02	charon		07[ENC] <328> parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]
Apr 18 17:03:02	charon		07[CFG] <328> looking for peer configs matching y.y.y.y[xxx.dyndns-web.com]...x.x.x.x[172.20.10.9]
Apr 18 17:03:02	charon		07[CFG] <con1|328>selected peer config 'con1'
Apr 18 17:03:02	charon		07[IKE] <con1|328>initiating EAP_IDENTITY method (id 0x00)
Apr 18 17:03:02	charon		07[IKE] <con1|328>received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Apr 18 17:03:02	charon		07[IKE] <con1|328>peer supports MOBIKE
Apr 18 17:03:02	charon		07[IKE] <con1|328>authentication of 'xxx.dyndns-web.com' (myself) with RSA signature successful
Apr 18 17:03:02	charon		07[IKE] <con1|328>sending end entity cert "C=US, ST=Wisconsin, L=Madison, O=Xinu, E=zach@xinu.io, CN=xxx.dyndns-web.com"
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>splitting IKE message with length of 1596 bytes into 4 fragments
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ EF(1/4) ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ EF(2/4) ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ EF(3/4) ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ EF(4/4) ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (544 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (544 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (544 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (144 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (84 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed IKE_AUTH request 2 [ EAP/RES/ID ]
Apr 18 17:03:02	charon		07[IKE] <con1|328>received EAP identity 'remoteuser@domain.io'
Apr 18 17:03:02	charon		07[IKE] <con1|328>initiating EAP_MSCHAPV2 method (id 0x14)
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (100 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (140 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (132 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (68 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
Apr 18 17:03:02	charon		07[IKE] <con1|328>EAP method EAP_MSCHAPV2 succeeded, MSK established
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 4 [ EAP/SUCC ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (68 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (84 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed IKE_AUTH request 5 [ AUTH ]
Apr 18 17:03:02	charon		07[IKE] <con1|328>authentication of '172.20.10.9' with EAP successful
Apr 18 17:03:02	charon		07[IKE] <con1|328>authentication of 'xxx.dyndns-web.com' (myself) with EAP
Apr 18 17:03:02	charon		07[IKE] <con1|328>IKE_SA con1[328] established between y.y.y.y[xxx.dyndns-web.com]...x.x.x.x[172.20.10.9]
Apr 18 17:03:02	charon		07[IKE] <con1|328>scheduling reauthentication in 28169s
Apr 18 17:03:02	charon		07[IKE] <con1|328>maximum IKE_SA lifetime 28709s
Apr 18 17:03:02	charon		07[IKE] <con1|328>peer requested virtual IP %any
Apr 18 17:03:02	charon		07[CFG] <con1|328>reassigning offline lease to 'remoteuser@domain.io'
Apr 18 17:03:02	charon		07[IKE] <con1|328>assigning virtual IP 10.10.10.1 to peer 'remoteuser@domain.io'
Apr 18 17:03:02	charon		07[IKE] <con1|328>peer requested virtual IP %any6
Apr 18 17:03:02	charon		07[IKE] <con1|328>no virtual IP found for %any6 requested by 'remoteuser@domain.io'
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to delete SAD entry with SPI cd6f355a
Apr 18 17:03:02	charon		07[KNL] <con1|328>deleting SPI allocation SA failed
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to add SAD entry with SPI cd6f355a
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to add SAD entry with SPI 0b91cd64
Apr 18 17:03:02	charon		07[IKE] <con1|328>unable to install inbound and outbound IPsec SA (SAD) in kernel
Apr 18 17:03:02	charon		07[IKE] <con1|328>failed to establish CHILD_SA, keeping IKE_SA
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to delete SAD entry with SPI cd6f355a
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to delete SAD entry with SPI 0b91cd64
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS DNS U_DEFDOM U_SPLITDNS) N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(NO_PROP) ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (212 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (68 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed INFORMATIONAL request 6 [ D ]
Apr 18 17:03:02	charon		07[IKE] <con1|328>received DELETE for IKE_SA con1[328]
Apr 18 17:03:02	charon		07[IKE] <con1|328>deleting IKE_SA con1[328] between y.y.y.y[xxx.dyndns-web.com]...x.x.x.x[172.20.10.9]
Apr 18 17:03:02	charon		07[IKE] <con1|328>IKE_SA deleted
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating INFORMATIONAL response 6 [ ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (60 bytes)
Apr 18 17:03:02	charon		07[CFG] <con1|328>lease 10.10.10.1 by 'remoteuser@domain.io' went offline</con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328>
            1 Reply Last reply Reply Quote 0
            • S
              shthead
              last edited by

              For me I can confirm that removing the OpenBGPD package resolves the problem with the tunnels - IPSEC works fine for me after that. Unfortunately I require OpenBGPD though, so its not a real fix for my situation. Does anyone have any other ideas of what to try?

              1 Reply Last reply Reply Quote 0
              • A
                Arendtsen
                last edited by

                I have now removed openbgpd and rebooted.
                Keeping an eye on it the next couple of days.

                1 Reply Last reply Reply Quote 0
                • V
                  vsxi-13
                  last edited by

                  @vsxi-13:

                  Running into what appears to be the same issue.  I've installed the patch that CMB put up and I'm testing it out.  I don't IPsec a lot, but I'll see about trying to do some more in the next couple days to see if this remains fixed.  Luckily I have an OpenVPN connection that I use for other services that I can get back in and stop/start the IPSec service.  Below is a sanitized version of the error message:

                  
Apr 18 17:03:02	charon		07[NET] <328> received packet: from x.x.x.x[63521] to y.y.y.y[500] (300 bytes)
Apr 18 17:03:02	charon		07[ENC] <328> parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
Apr 18 17:03:02	charon		07[IKE] <328> x.x.x.x is initiating an IKE_SA
Apr 18 17:03:02	charon		07[IKE] <328> remote host is behind NAT
Apr 18 17:03:02	charon		07[IKE] <328> sending cert request for "C=US, ST=Wisconsin, L=Madison, O=Xinu, E=zach@xinu.io, CN=dd13-CA"
Apr 18 17:03:02	charon		07[ENC] <328> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(MULT_AUTH) ]
Apr 18 17:03:02	charon		07[NET] <328> sending packet: from y.y.y.y[500] to x.x.x.x[63521] (341 bytes)
Apr 18 17:03:02	charon		07[NET] <328> received packet: from x.x.x.x[4244] to y.y.y.y[4500] (332 bytes)
Apr 18 17:03:02	charon		07[ENC] <328> parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]
Apr 18 17:03:02	charon		07[CFG] <328> looking for peer configs matching y.y.y.y[xxx.dyndns-web.com]...x.x.x.x[172.20.10.9]
Apr 18 17:03:02	charon		07[CFG] <con1|328>selected peer config 'con1'
Apr 18 17:03:02	charon		07[IKE] <con1|328>initiating EAP_IDENTITY method (id 0x00)
Apr 18 17:03:02	charon		07[IKE] <con1|328>received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Apr 18 17:03:02	charon		07[IKE] <con1|328>peer supports MOBIKE
Apr 18 17:03:02	charon		07[IKE] <con1|328>authentication of 'xxx.dyndns-web.com' (myself) with RSA signature successful
Apr 18 17:03:02	charon		07[IKE] <con1|328>sending end entity cert "C=US, ST=Wisconsin, L=Madison, O=Xinu, E=zach@xinu.io, CN=xxx.dyndns-web.com"
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>splitting IKE message with length of 1596 bytes into 4 fragments
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ EF(1/4) ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ EF(2/4) ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ EF(3/4) ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 1 [ EF(4/4) ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (544 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (544 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (544 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (144 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (84 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed IKE_AUTH request 2 [ EAP/RES/ID ]
Apr 18 17:03:02	charon		07[IKE] <con1|328>received EAP identity 'remoteuser@domain.io'
Apr 18 17:03:02	charon		07[IKE] <con1|328>initiating EAP_MSCHAPV2 method (id 0x14)
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (100 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (140 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (132 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (68 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
Apr 18 17:03:02	charon		07[IKE] <con1|328>EAP method EAP_MSCHAPV2 succeeded, MSK established
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 4 [ EAP/SUCC ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (68 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (84 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed IKE_AUTH request 5 [ AUTH ]
Apr 18 17:03:02	charon		07[IKE] <con1|328>authentication of '172.20.10.9' with EAP successful
Apr 18 17:03:02	charon		07[IKE] <con1|328>authentication of 'xxx.dyndns-web.com' (myself) with EAP
Apr 18 17:03:02	charon		07[IKE] <con1|328>IKE_SA con1[328] established between y.y.y.y[xxx.dyndns-web.com]...x.x.x.x[172.20.10.9]
Apr 18 17:03:02	charon		07[IKE] <con1|328>scheduling reauthentication in 28169s
Apr 18 17:03:02	charon		07[IKE] <con1|328>maximum IKE_SA lifetime 28709s
Apr 18 17:03:02	charon		07[IKE] <con1|328>peer requested virtual IP %any
Apr 18 17:03:02	charon		07[CFG] <con1|328>reassigning offline lease to 'remoteuser@domain.io'
Apr 18 17:03:02	charon		07[IKE] <con1|328>assigning virtual IP 10.10.10.1 to peer 'remoteuser@domain.io'
Apr 18 17:03:02	charon		07[IKE] <con1|328>peer requested virtual IP %any6
Apr 18 17:03:02	charon		07[IKE] <con1|328>no virtual IP found for %any6 requested by 'remoteuser@domain.io'
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to delete SAD entry with SPI cd6f355a
Apr 18 17:03:02	charon		07[KNL] <con1|328>deleting SPI allocation SA failed
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to add SAD entry with SPI cd6f355a
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to add SAD entry with SPI 0b91cd64
Apr 18 17:03:02	charon		07[IKE] <con1|328>unable to install inbound and outbound IPsec SA (SAD) in kernel
Apr 18 17:03:02	charon		07[IKE] <con1|328>failed to establish CHILD_SA, keeping IKE_SA
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to delete SAD entry with SPI cd6f355a
Apr 18 17:03:02	charon		07[KNL] <con1|328>error sending to PF_KEY socket: No buffer space available
Apr 18 17:03:02	charon		07[KNL] <con1|328>unable to delete SAD entry with SPI 0b91cd64
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS DNS U_DEFDOM U_SPLITDNS) N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(NO_PROP) ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (212 bytes)
Apr 18 17:03:02	charon		07[NET] <con1|328>received packet: from x.x.x.x[4244] to y.y.y.y[4500] (68 bytes)
Apr 18 17:03:02	charon		07[ENC] <con1|328>parsed INFORMATIONAL request 6 [ D ]
Apr 18 17:03:02	charon		07[IKE] <con1|328>received DELETE for IKE_SA con1[328]
Apr 18 17:03:02	charon		07[IKE] <con1|328>deleting IKE_SA con1[328] between y.y.y.y[xxx.dyndns-web.com]...x.x.x.x[172.20.10.9]
Apr 18 17:03:02	charon		07[IKE] <con1|328>IKE_SA deleted
Apr 18 17:03:02	charon		07[ENC] <con1|328>generating INFORMATIONAL response 6 [ ]
Apr 18 17:03:02	charon		07[NET] <con1|328>sending packet: from y.y.y.y[4500] to x.x.x.x[4244] (60 bytes)
Apr 18 17:03:02	charon		07[CFG] <con1|328>lease 10.10.10.1 by 'remoteuser@domain.io' went offline</con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328></con1|328>

                  Issue reoccurred for me today again.  Had to connect back through OpenVPN tunnel and manually stop/start the IPSec service in order to authenticate via IPSec from my Macbook air.  It doesn't appear the fix from earlier is working for me on a permanent basis.

                  1 Reply Last reply Reply Quote 0
                  • C
                    cmb
                    last edited by

                    There are two separate issues here with the same symptom. The starting twice problem is fixed by what I posted earlier in the thread. The issue with openbgpd causing that same PF_KEY error doesn't have a known cause or solution yet. I'm attempting to replicate that one.

                    1 Reply Last reply Reply Quote 0
                    • S
                      shthead
                      last edited by

                      cmb, if you would like access to my pfSense server that has the OpenBGPD issue again let me know and I will message you the details.

                      1 Reply Last reply Reply Quote 0
                      • V
                        vsxi-13
                        last edited by

                        I'm not running OpenBGPD.  I'll review, but I'm pretty sure I applied that patch successfully utilizing the patch package utility…

                        Edit:  It's definitely installed.  I navigated out to the file in question to check for the additions that were added and they're there.

                        I haven't done a full reboot, would that have any chance of affecting the application of the fix?

                        1 Reply Last reply Reply Quote 0
                        • C
                          cmb
                          last edited by

                          @vsxi-13:

                          I'm not running OpenBGPD.  I'll review, but I'm pretty sure I applied that patch successfully utilizing the patch package utility…

                          Edit:  It's definitely installed.  I navigated out to the file in question to check for the additions that were added and they're there.

                          I haven't done a full reboot, would that have any chance of affecting the application of the fix?

                          You have to either manually kill off the duplicate instances of strongswan (ipsec and charon processes), or reboot after applying that. That just prevents the problem circumstance from happening again.

                          1 Reply Last reply Reply Quote 0
                          • V
                            vsxi-13
                            last edited by

                            @cmb:

                            @vsxi-13:

                            I'm not running OpenBGPD.  I'll review, but I'm pretty sure I applied that patch successfully utilizing the patch package utility…

                            Edit:  It's definitely installed.  I navigated out to the file in question to check for the additions that were added and they're there.

                            I haven't done a full reboot, would that have any chance of affecting the application of the fix?

                            You have to either manually kill off the duplicate instances of strongswan (ipsec and charon processes), or reboot after applying that. That just prevents the problem circumstance from happening again.

                            I'm going to keep an eye on it.  I rebooted today, however I also just rebuilt my pfSense and am running it virtually now in VMWare with essentially the same configuration.

                            1 Reply Last reply Reply Quote 0
                            • V
                              vsxi-13
                              last edited by

                              @vsxi-13:

                              @cmb:

                              @vsxi-13:

                              I'm not running OpenBGPD.  I'll review, but I'm pretty sure I applied that patch successfully utilizing the patch package utility…

                              Edit:  It's definitely installed.  I navigated out to the file in question to check for the additions that were added and they're there.

                              I haven't done a full reboot, would that have any chance of affecting the application of the fix?

                              You have to either manually kill off the duplicate instances of strongswan (ipsec and charon processes), or reboot after applying that. That just prevents the problem circumstance from happening again.

                              I'm going to keep an eye on it.  I rebooted today, however I also just rebuilt my pfSense and am running it virtually now in VMWare with essentially the same configuration.

                              This would have been a great weekend to test this, however my Macbook has decided that it doesn't want to run IKEv2 anymore…

                              
Apr 22 07:34:01 mba nesessionmanager[427]: NESMIKEv2VPNSession[xxxx.dyndns-web.com:4B453608-183B-4727-B69F-DB98737FCCD7]: Received a start command from SystemUIServer[239]
Apr 22 07:34:01 mba nesessionmanager[427]: NESMIKEv2VPNSession[xxxx.dyndns-web.com:4B453608-183B-4727-B69F-DB98737FCCD7]: status changed to connecting
Apr 22 07:34:01 mba nesessionmanager[427]: Failed to find the VPN app for plugin type com.apple.neplugin.IKEv2
Apr 22 07:34:01 mba neagent[926]: IKEv2 Plugin: ikev2_dns_callback: Error -65554
Apr 22 07:34:02 mba kernel[0]: ipsec_ctl_connect: creating interface ipsec0
Apr 22 07:34:02 mba configd[51]: network changed
Apr 22 07:34:04 mba neagent[926]: MSCHAPv2 Error = 691, Retry = 1, Version = 0
Apr 22 07:34:04 mba neagent[926]: Failed to process IKE Auth (EAP) packet
Apr 22 07:34:04 mba neagent[926]: BUG in libdispatch client: kevent[EVFILT_READ] delete: "Bad file descriptor" - 0x9
Apr 22 07:34:04 mba nesessionmanager[427]: NESMIKEv2VPNSession[xxxx.dyndns-web.com:4B453608-183B-4727-B69F-DB98737FCCD7]: status changed to disconnecting
Apr 22 07:34:04 mba kernel[0]: SIOCPROTODETACH_IN6: ipsec0 error=6
Apr 22 07:34:04 mba nesessionmanager[427]: NESMIKEv2VPNSession[xxxx.dyndns-web.com:4B453608-183B-4727-B69F-DB98737FCCD7]: status changed to disconnected, last stop reason $
Apr 22 07:34:04 mba configd[51]: network changed
Apr 22 07:34:04 mba symptomsd[422]: nw_interface_get_agents SIOCGIFAGENTIDS failed for interface "ipsec0" (index 8, type other): [6] Device not configured

                              Of course there a good amount of posts showing this as a problem on google, but no real resolutions…  My personal and work iPhone connect without a hitch, so it's definitely not pfSense side :(

                              1 Reply Last reply Reply Quote 0
                              • Z
                                zdunn
                                last edited by

                                I am in the same boat.  I have two pfSense boxes in an HA pair running 2.3, with BGP and an IPSec VPN.  I'm happy to help test whatever patch etc as needed.

                                1 Reply Last reply Reply Quote 0
                                • A
                                  Arendtsen
                                  last edited by

                                  Can now confirm that after removing openbgpd I havn't have had any IPSEC tunnels inactive.

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    choudharyprabhat
                                    last edited by

                                    Hi All ,

                                    I am a newbie in pfsense , i have recently updated on pfsense 2.3 (AMD 64) ,all the things were working like a charm including IPSEC tunnels before installing OpenBgpd, as per our requirement i have installed OpenBGPD both IPsec and OpenBgpd worked for some hours ….....then all the IPSEC tunnels gone down , In Gui configuration tunnels still showing in established state but no traffic passing , for fixing the issue i have to restart the firewall , then it again starts working for some hours .

                                    I have tried these below steps also but all goes in vain  :'(

                                    killall -9 charon
                                    killall -9 starter
                                    ipsec stop
                                    ipsec start

                                    ipsec start states as :-

                                    Starting strongSwan 5.4.0 IPsec [starter]…
                                    charon is already running (/var/run/charon.pid exists) -- skipping daemon start
                                    no netkey IPsec stack detected
                                    no KLIPS IPsec stack detected
                                    no known IPsec stack detected, ignoring!
                                    starter is already running (/var/run/starter.charon.pid exists) -- no fork done

                                    Please suggest anybody i am using pfsense in production environment  :'(

                                    I was wondering if a downgrade to previous version can fix this issue , is any version is workable with both IPSEC and OPENBGPD.
                                    Please if anyone have any idea on this .

                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      fattylewis
                                      last edited by

                                      @choudharyprabhat:

                                      Hi All ,

                                      I am a newbie in pfsense , i have recently updated on pfsense 2.3 (AMD 64) ,all the things were working like a charm including IPSEC tunnels before installing OpenBgpd, as per our requirement i have installed OpenBGPD both IPsec and OpenBgpd worked for some hours ….....then all the IPSEC tunnels gone down , In Gui configuration tunnels still showing in established state but no traffic passing , for fixing the issue i have to restart the firewall , then it again starts working for some hours .

                                      I have tried these below steps also but all goes in vain  :'(

                                      killall -9 charon
                                      killall -9 starter
                                      ipsec stop
                                      ipsec start

                                      ipsec start states as :-

                                      Starting strongSwan 5.4.0 IPsec [starter]…
                                      charon is already running (/var/run/charon.pid exists) -- skipping daemon start
                                      no netkey IPsec stack detected
                                      no KLIPS IPsec stack detected
                                      no known IPsec stack detected, ignoring!
                                      starter is already running (/var/run/starter.charon.pid exists) -- no fork done

                                      Please suggest anybody i am using pfsense in production environment  :'(

                                      I was wondering if a downgrade to previous version can fix this issue , is any version is workable with both IPSEC and OPENBGPD.
                                      Please if anyone have any idea on this .

                                      Dude, you shouldnt have updated a prod system to 2.3 without testing!

                                      Anyway, yes i can confirm 2.2.6 works perfectly with IPSEC and openbgpd. Im using it myself on a prod network.

                                      There is an open bug report for this issue: https://redmine.pfsense.org/issues/6223

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        choudharyprabhat
                                        last edited by

                                        Thanks fattylewis , i have downgraded my pfsense box to 2.2.6 , now everything is working fine.  :) ;D

                                        there is one more thing to notice :- when i had edited /boot/loder.config.local >>>> net.inet.raw.maxdgram="131072"
                                        net.inet.raw.recvspace="131072" .

                                        Pfsense worked like charm with ipsec and bgp even on pfsense 2.3. :)

                                        for me that trick worked.

                                        Thanks CMB and fattylewis for your replies….you guys rocksssss..  ;)

                                        1 Reply Last reply Reply Quote 0
                                        • F
                                          fattylewis
                                          last edited by

                                          @choudharyprabhat:

                                          Thanks fattylewis , i have downgraded my pfsense box to 2.2.6 , now everything is working fine.  :) ;D

                                          there is one more thing to notice :- when i had edited /boot/loder.config.local >>>> net.inet.raw.maxdgram="131072"
                                          net.inet.raw.recvspace="131072" .

                                          Pfsense worked like charm with ipsec and bgp even on pfsense 2.3. :)

                                          for me that trick worked.

                                          Thanks CMB and fattylewis for your replies….you guys rocksssss..  ;)

                                          Oh, nice find. Ill see about knocking up another network on 2.3 and adding your change and seeing what happens.

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            timw
                                            last edited by

                                            We've also had this issue on 2.3, and as we required BGP for our network, we've downgraded back to 2.2.6

                                            Looking forward to a confirmed fix (need to wait until after hours again to try the upgrade again)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.