Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Only 1 IPSec VPN Tunnel Can be UP at a Time

    Scheduled Pinned Locked Moved IPsec
    21 Posts 3 Posters 2.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      samyboyz
      last edited by

      Feb 20 00:08:12 charon 06[IKE] <con2000|4784>activating new tasks
      Feb 20 00:08:12 charon 06[IKE] <con2000|4784>activating ISAKMP_DPD task
      Feb 20 00:08:12 charon 06[ENC] <con2000|4784>generating INFORMATIONAL_V1 request 3717885545 [ HASH N(DPD) ]
      Feb 20 00:08:12 charon 06[NET] <con2000|4784>sending packet: from 70.29.148.187[500] to 70.49.70.217[500] (84 bytes)
      Feb 20 00:08:12 charon 06[IKE] <con2000|4784>activating new tasks
      Feb 20 00:08:12 charon 06[IKE] <con2000|4784>nothing to initiate
      Feb 20 00:08:12 charon 06[NET] <con2000|4784>received packet: from 70.49.70.217[500] to 70.29.148.187[500] (84 bytes)
      Feb 20 00:08:12 charon 06[ENC] <con2000|4784>parsed INFORMATIONAL_V1 request 2002702379 [ HASH N(DPD_ACK) ]
      Feb 20 00:08:12 charon 06[IKE] <con2000|4784>activating new tasks
      Feb 20 00:08:12 charon 06[IKE] <con2000|4784>nothing to initiate
      Feb 20 00:08:12 charon 06[NET] <4795> received packet: from 70.53.184.37[500] to 70.29.148.187[500] (108 bytes)
      Feb 20 00:08:12 charon 06[ENC] <4795> invalid ID_V1 payload length, decryption failed?
      Feb 20 00:08:12 charon 06[ENC] <4795> could not decrypt payloads
      Feb 20 00:08:12 charon 06[IKE] <4795> message parsing failed
      Feb 20 00:08:12 charon 06[ENC] <4795> generating INFORMATIONAL_V1 request 1589880556 [ HASH N(PLD_MAL) ]
      Feb 20 00:08:12 charon 06[NET] <4795> sending packet: from 70.29.148.187[500] to 70.53.184.37[500] (92 bytes)
      Feb 20 00:08:12 charon 06[IKE] <4795> ID_PROT request with message ID 0 processing failed
      Feb 20 00:08:20 charon 06[NET] <4795> received packet: from 70.53.184.37[500] to 70.29.148.187[500] (108 bytes)
      Feb 20 00:08:20 charon 06[ENC] <4795> invalid ID_V1 payload length, decryption failed?
      Feb 20 00:08:20 charon 06[ENC] <4795> could not decrypt payloads
      Feb 20 00:08:20 charon 06[IKE] <4795> message parsing failed
      Feb 20 00:08:20 charon 06[ENC] <4795> generating INFORMATIONAL_V1 request 3774258457 [ HASH N(PLD_MAL) ]
      Feb 20 00:08:20 charon 06[NET] <4795> sending packet: from 70.29.148.187[500] to 70.53.184.37[500] (92 bytes)
      Feb 20 00:08:20 charon 06[IKE] <4795> ID_PROT request with message ID 0 processing failed
      Feb 20 00:08:22 charon 06[IKE] <con2000|4784>sending DPD request
      Feb 20 00:08:22 charon 06[IKE] <con2000|4784>queueing ISAKMP_DPD task
      Feb 20 00:08:22 charon 06[IKE] <con2000|4784>activating new tasks
      Feb 20 00:08:22 charon 06[IKE] <con2000|4784>activating ISAKMP_DPD task
      Feb 20 00:08:22 charon 06[ENC] <con2000|4784>generating INFORMATIONAL_V1 request 2948983483 [ HASH N(DPD) ]
      Feb 20 00:08:22 charon 06[NET] <con2000|4784>sending packet: from 70.29.148.187[500] to 70.49.70.217[500] (84 bytes)
      Feb 20 00:08:22 charon 06[IKE] <con2000|4784>activating new tasks
      Feb 20 00:08:22 charon 06[IKE] <con2000|4784>nothing to initiate
      Feb 20 00:08:22 charon 06[NET] <con2000|4784>received packet: from 70.49.70.217[500] to 70.29.148.187[500] (84 bytes)
      Feb 20 00:08:22 charon 06[ENC] <con2000|4784>parsed INFORMATIONAL_V1 request 545605263 [ HASH N(DPD_ACK) ]
      Feb 20 00:08:22 charon 06[IKE] <con2000|4784>activating new tasks
      Feb 20 00:08:22 charon 06[IKE] <con2000|4784>nothing to initiate
      Feb 20 00:08:32 charon 12[IKE] <con2000|4784>sending DPD request
      Feb 20 00:08:32 charon 12[IKE] <con2000|4784>queueing ISAKMP_DPD task
      Feb 20 00:08:32 charon 12[IKE] <con2000|4784>activating new tasks
      Feb 20 00:08:32 charon 12[IKE] <con2000|4784>activating ISAKMP_DPD task
      Feb 20 00:08:32 charon 12[ENC] <con2000|4784>generating INFORMATIONAL_V1 request 4259553075 [ HASH N(DPD) ]
      Feb 20 00:08:32 charon 12[NET] <con2000|4784>sending packet: from 70.29.148.187[500] to 70.49.70.217[500] (84 bytes)
      Feb 20 00:08:32 charon 12[IKE] <con2000|4784>activating new tasks
      Feb 20 00:08:32 charon 12[IKE] <con2000|4784>nothing to initiate
      Feb 20 00:08:32 charon 12[NET] <con2000|4784>received packet: from 70.49.70.217[500] to 70.29.148.187[500] (84 bytes)
      Feb 20 00:08:32 charon 12[ENC] <con2000|4784>parsed INFORMATIONAL_V1 request 3826683002 [ HASH N(DPD_ACK) ]
      Feb 20 00:08:32 charon 12[IKE] <con2000|4784>activating new tasks
      Feb 20 00:08:32 charon 12[IKE] <con2000|4784>nothing to initiate
      Feb 20 00:08:34 charon 12[JOB] <4795> deleting half open IKE_SA with 70.53.184.37 after timeout
      Feb 20 00:08:34 charon 12[IKE] <4795> IKE_SA (unnamed)[4795] state change: CONNECTING => DESTROYING</con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784></con2000|4784>

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Looks like one side is failing and the other doesn't know it.

        You'll probably have to post the IKE and IPsec configurations from both sides.

        Are you trying to get two tunnels up between the same two endpoints?

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • S
          samyboyz
          last edited by

          Funny thing is the tunnel worked until it stopped working on its own..i wanna get 3 tunnels to 3 different sites with all of them setup on Zyxel routers. I manage to get all 3 up, then they drop like flies lol

          Attached are config details:

          ![Screen Shot 02-20-18 at 11.28 AM.JPG](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.28 AM.JPG)
          ![Screen Shot 02-20-18 at 11.28 AM.JPG_thumb](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.28 AM.JPG_thumb)
          ![Screen Shot 02-20-18 at 11.29 AM.JPG](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.29 AM.JPG)
          ![Screen Shot 02-20-18 at 11.29 AM.JPG_thumb](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.29 AM.JPG_thumb)
          ![Screen Shot 02-20-18 at 11.31 AM 001.JPG](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.31 AM 001.JPG)
          ![Screen Shot 02-20-18 at 11.31 AM 001.JPG_thumb](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.31 AM 001.JPG_thumb)
          ![Screen Shot 02-20-18 at 11.31 AM 002.JPG](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.31 AM 002.JPG)
          ![Screen Shot 02-20-18 at 11.31 AM 002.JPG_thumb](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.31 AM 002.JPG_thumb)
          ![Screen Shot 02-20-18 at 11.31 AM.JPG](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.31 AM.JPG)
          ![Screen Shot 02-20-18 at 11.31 AM.JPG_thumb](/public/imported_attachments/1/Screen Shot 02-20-18 at 11.31 AM.JPG_thumb)

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            That all looks OK at first glance. I would Uncheck disable re-key on the pfSense side.

            And please change the PSK. :)

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • dotdashD
              dotdash
              last edited by

              I do not understand what you are doing with the identifiers on the pfsense p1.
              Normally, In that situation, I'd use DN and put in the dyndns hostname. Not sure what you are doing with the 0.0.0.0

              1 Reply Last reply Reply Quote 0
              • S
                samyboyz
                last edited by

                Hi! Thanks for helping me out, i appreciate it! :)

                I did disable re-key, but no dices..say i delete the pfsense side and re-create exactly, it will work..very weird

                @Derelict:

                That all looks OK at first glance. I would Uncheck disable re-key on the pfSense side.

                And please change the PSK. :)

                1 Reply Last reply Reply Quote 0
                • S
                  samyboyz
                  last edited by

                  Hi,

                  DNS or 0.0.0.0, as long as the values match on both sides, i think we ok if i'm not mistaken.

                  @dotdash:

                  I do not understand what you are doing with the identifiers on the pfsense p1.
                  Normally, In that situation, I'd use DN and put in the dyndns hostname. Not sure what you are doing with the 0.0.0.0

                  1 Reply Last reply Reply Quote 0
                  • S
                    samyboyz
                    last edited by

                    Disabling NAT Traversal on all tunnels except for the one that had it enabled and was working fixed the issue, all 4 tunnels are working now…

                    I'm confused as to why though..

                    1 Reply Last reply Reply Quote 0
                    • S
                      samyboyz
                      last edited by

                      Any reason why tunnels like freeze and rekey every 6-7min?

                      1 Reply Last reply Reply Quote 0
                      • dotdashD
                        dotdash
                        last edited by

                        @Sarven:

                        Any reason why tunnels like freeze and rekey every 6-7min?

                        You seem confident that it has nothing to do with using a wildcard that matches anything for your identifiers. That's all I got, so good luck.

                        1 Reply Last reply Reply Quote 0
                        • S
                          samyboyz
                          last edited by

                          Thanks Buddy

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.