• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Problems with IPsec vpn between pfSense and Oracle Cloud Infrastructure

Scheduled Pinned Locked Moved IPsec
18 Posts 3 Posters 3.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    Derelict LAYER 8 Netgate
    last edited by Sep 4, 2018, 1:44 AM

    IPsec does not work like that (yet. VTI IPsec coming in 2.4.4 does).

    You create a "Phase 2" entry for:

    Local: 192.168.1.0/24
    Remote: 10.72.0.0/16

    If that comes up, it establishes kernel traffic selectors that put matching traffic through IPsec.

    Status > IPsec, SPDs will show them.

    Chattanooga, Tennessee, USA
    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
    Do Not Chat For Help! NO_WAN_EGRESS(TM)

    1 Reply Last reply Reply Quote 0
    • R
      RodrigoCBraga
      last edited by Sep 4, 2018, 4:09 PM

      Thank you for help.
      My SPD view
      My question is regarding the rules for establishing communication after the ipsec tunnel is established and how do I monitor traffic?
      On the other side I asked the logs to try to identify if the internal network communication 192.168.1.0/24 is being blocked.
      Thank you again.

      1 Reply Last reply Reply Quote 0
      • D
        Derelict LAYER 8 Netgate
        last edited by Sep 4, 2018, 4:16 PM

        Firewall rules on IPsec govern connections originating from the other side of the IPsec tunnels.

        Firewall rules on the local interfaces govern connections coming into the firewall from the hosts connected there.

        https://www.netgate.com/docs/pfsense/firewall/firewall-rule-basics.html

        https://www.netgate.com/docs/pfsense/firewall/firewall-rule-troubleshooting.html

        https://www.netgate.com/docs/pfsense/book/firewall/troubleshooting-firewall-rules.html

        As for "Monitoring" that is a fairly generic term. What are you actually looking to do?

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • R
          RodrigoCBraga
          last edited by Sep 4, 2018, 4:34 PM

          @derelict said in Problems with IPsec vpn between pfSense and Oracle Cloud Infrastructure:

          As for "Monitoring" that is a fairly generic term. What are you actually looking to do?

          I'm trying to identify on which side is the problem.
          If it is some configuration in pfSense or OCI.
          I performed some tests as a tracert and did not succeed when I ran the tracert from a workstation on the 192.168.1.0/24 network.
          On the other hand was informed that I could try to access via remote desktop to a certain ip on the internal network 10.72.0.0/16.
          Both tests failed.
          The phase 2 setup is the same as the one you set.
          Thank you for your help.

          1 Reply Last reply Reply Quote 0
          • D
            Derelict LAYER 8 Netgate
            last edited by Sep 4, 2018, 4:41 PM

            You can packet capture on the IPsec interface (enc0) to see if pings are going out, replies are being received, etc.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • R
              RodrigoCBraga
              last edited by Sep 6, 2018, 3:19 PM

              Thanks for your help.
              The client said that analyzing the logs and with a similar problem they had with a PaloAlto solution is necessary to include a new remote network 0.0.0.0/0.
              I need help to do this procedure, because when I try to create a network there is no / 0 option. Can you help me?

              Security Parameter Index

              The Oracle Cloud Infrastructure VPN headends use next-hop-based tunnels. When you create a new IPSec connection, you specify a list of IPv4 networks that should be routed from your dynamic routing gateway (DRG) through the IPSec tunnel to your CPE.

              Oracle IPSec ProxyIDs

              local=0.0.0.0/0
              remote=0.0.0.0/0
              service=any

              https://docs.cloud.oracle.com/iaas/Content/Network/Reference/genericCPE.htm

              1 Reply Last reply Reply Quote 0
              • D
                Derelict LAYER 8 Netgate
                last edited by Derelict Sep 6, 2018, 3:58 PM Sep 6, 2018, 3:56 PM

                Site-to-site tunnels to 0.0.0.0/0 will catch all traffic from the source network including traffic to the internet. I would not recommend doing that, and it is doubtful Oracle cloud IPsec requires it.

                If the networks in your Phase 2 are the problem, that will show in the IPsec logs. Check the log settings )VPN> IPsec, Advanced) and be sure that IKE SA, IKE Child SA, and Configuration Backend are set to Diag. Everything else can be Control.

                Look at where it is failing and compare with this:

                https://www.netgate.com/docs/pfsense/vpn/ipsec/ipsec-troubleshooting.html

                Or, of course, you can post the logs here.

                When you create a new IPSec connection, you specify a list of IPv4 networks that should be routed from your dynamic routing gateway (DRG) through the IPSec tunnel to your CPE.

                Right. All of those routed networks should be specified as Local Networks in Phase 2 entries on your side. The Cloud CIDR should be the Remote Network for all of them.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • R
                  RodrigoCBraga
                  last edited by Sep 6, 2018, 10:12 PM

                  LogPart1
                  LogPart2
                  LogPart3
                  LogPart4
                  LogPart5
                  LogPart6
                  IPSEC
                  IPSEC RULES
                  NATOUTBOUND
                  RULES WAN
                  STATE FILTER
                  STATIC RULES

                  My set up.
                  I hope you can help me.
                  Thanks.

                  1 Reply Last reply Reply Quote 0
                  • D
                    Derelict LAYER 8 Netgate
                    last edited by Sep 6, 2018, 10:36 PM

                    Delete any static routes you added like that 10.72.0.0/16 to 192.168.1.1. That is not how IPsec works.

                    Honestly, it looks like your IPsec is doing what you asked it to do. Need to find out why the host in the cloud (10.72.112.30) isn't responding or why your traffic isn't coming back. That's more of an oracle question.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    R 1 Reply Last reply Sep 19, 2018, 2:39 PM Reply Quote 0
                    • R
                      RodrigoCBraga
                      last edited by Sep 6, 2018, 10:44 PM

                      This post is deleted!
                      1 Reply Last reply Reply Quote 0
                      • R
                        RodrigoCBraga
                        last edited by RodrigoCBraga Sep 13, 2018, 4:51 PM Sep 13, 2018, 4:50 PM

                        I have a doubt.
                        In pfsense it is possible to do configuration where in phase 2 has the network 0.0.0.0/0 as local and remote?
                        Attached, screen with configuration between Palo Alto firewall and Oracle Cloud Infrastructure.
                        Palo Alto Phase 2

                        1 Reply Last reply Reply Quote 0
                        • R
                          RodrigoCBraga @Derelict
                          last edited by Sep 19, 2018, 2:39 PM

                          @derelict
                          Hello, can you still help me?

                          1 Reply Last reply Reply Quote 0
                          • D
                            Derelict LAYER 8 Netgate
                            last edited by Sep 19, 2018, 3:33 PM

                            Help how?

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            R E 2 Replies Last reply Sep 19, 2018, 3:36 PM Reply Quote 0
                            • R
                              RodrigoCBraga @Derelict
                              last edited by Sep 19, 2018, 3:36 PM

                              @derelict said in Problems with IPsec vpn between pfSense and Oracle Cloud Infrastructure:

                              Help how?
                              Yes.

                              I have a doubt.
                              In pfsense it is possible to do configuration where in phase 2 has the network 0.0.0.0/0 as local and remote?
                              Attached, screen with configuration between Palo Alto firewall and Oracle Cloud Infrastructure.
                              Palo Alto Phase 2

                              1 Reply Last reply Reply Quote 0
                              • E
                                Ernani @Derelict
                                last edited by Sep 20, 2018, 7:14 PM

                                @derelict

                                Hello, I would like to ask your attention to verify Oracle documentation and to comment that Pfsense is compatible and support Oracle VPNAAS.
                                1 - Oracle documentation to a Generic CPE:
                                https://docs.cloud.oracle.com/iaas/Content/Network/Reference/genericCPE.htm

                                Requirements for generic CPE devices are:

                                local=0.0.0.0/0
                                remote=0.0.0.0/0
                                service=any

                                Please let us know your thoughts about that.

                                Regards,
                                Ernani

                                1 Reply Last reply Reply Quote 0
                                • D
                                  Derelict LAYER 8 Netgate
                                  last edited by Derelict Sep 20, 2018, 7:35 PM Sep 20, 2018, 7:19 PM

                                  Personal opinion:

                                  I think that is completely uncalled for.

                                  On pfSense that will catch all traffic and send it over the tunnel unless extreme measures are taken to bypass it. And there is no way to bypass traffic from the firewall itself.

                                  I cannot see how Oracle expects that to work for people.

                                  Again, you should be able to create Phase 2 entries with your cloud subnet as remote and your local subnet(s) as local.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  E 1 Reply Last reply Sep 20, 2018, 7:56 PM Reply Quote 0
                                  • E
                                    Ernani @Derelict
                                    last edited by Sep 20, 2018, 7:56 PM

                                    @derelict

                                    I agree with you, since I have configured others tunnels with different suppliers to Oracle without use that requirement, but I saw some intermittencies.

                                    Thank you,
                                    Ernani

                                    1 Reply Last reply Reply Quote 0
                                    18 out of 18
                                    • First post
                                      18/18
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                      This community forum collects and processes your personal information.
                                      consent.not_received