Problems with IPsec vpn between pfSense and Oracle Cloud Infrastructure
-
Thanks for your help.
The client said that analyzing the logs and with a similar problem they had with a PaloAlto solution is necessary to include a new remote network 0.0.0.0/0.
I need help to do this procedure, because when I try to create a network there is no / 0 option. Can you help me?Security Parameter Index
The Oracle Cloud Infrastructure VPN headends use next-hop-based tunnels. When you create a new IPSec connection, you specify a list of IPv4 networks that should be routed from your dynamic routing gateway (DRG) through the IPSec tunnel to your CPE.
Oracle IPSec ProxyIDs
local=0.0.0.0/0
remote=0.0.0.0/0
service=anyhttps://docs.cloud.oracle.com/iaas/Content/Network/Reference/genericCPE.htm
-
Site-to-site tunnels to 0.0.0.0/0 will catch all traffic from the source network including traffic to the internet. I would not recommend doing that, and it is doubtful Oracle cloud IPsec requires it.
If the networks in your Phase 2 are the problem, that will show in the IPsec logs. Check the log settings )VPN> IPsec, Advanced) and be sure that IKE SA, IKE Child SA, and Configuration Backend are set to Diag. Everything else can be Control.
Look at where it is failing and compare with this:
https://www.netgate.com/docs/pfsense/vpn/ipsec/ipsec-troubleshooting.html
Or, of course, you can post the logs here.
When you create a new IPSec connection, you specify a list of IPv4 networks that should be routed from your dynamic routing gateway (DRG) through the IPSec tunnel to your CPE.
Right. All of those routed networks should be specified as Local Networks in Phase 2 entries on your side. The Cloud CIDR should be the Remote Network for all of them.
-
LogPart1
LogPart2
LogPart3
LogPart4
LogPart5
LogPart6
IPSEC
IPSEC RULES
NATOUTBOUND
RULES WAN
STATE FILTER
STATIC RULESMy set up.
I hope you can help me.
Thanks. -
Delete any static routes you added like that 10.72.0.0/16 to 192.168.1.1. That is not how IPsec works.
Honestly, it looks like your IPsec is doing what you asked it to do. Need to find out why the host in the cloud (10.72.112.30) isn't responding or why your traffic isn't coming back. That's more of an oracle question.
-
This post is deleted! -
I have a doubt.
In pfsense it is possible to do configuration where in phase 2 has the network 0.0.0.0/0 as local and remote?
Attached, screen with configuration between Palo Alto firewall and Oracle Cloud Infrastructure.
Palo Alto Phase 2 -
@derelict
Hello, can you still help me? -
Help how?
-
@derelict said in Problems with IPsec vpn between pfSense and Oracle Cloud Infrastructure:
Help how?
Yes.I have a doubt.
In pfsense it is possible to do configuration where in phase 2 has the network 0.0.0.0/0 as local and remote?
Attached, screen with configuration between Palo Alto firewall and Oracle Cloud Infrastructure.
Palo Alto Phase 2 -
Hello, I would like to ask your attention to verify Oracle documentation and to comment that Pfsense is compatible and support Oracle VPNAAS.
1 - Oracle documentation to a Generic CPE:
https://docs.cloud.oracle.com/iaas/Content/Network/Reference/genericCPE.htmRequirements for generic CPE devices are:
local=0.0.0.0/0
remote=0.0.0.0/0
service=anyPlease let us know your thoughts about that.
Regards,
Ernani -
Personal opinion:
I think that is completely uncalled for.
On pfSense that will catch all traffic and send it over the tunnel unless extreme measures are taken to bypass it. And there is no way to bypass traffic from the firewall itself.
I cannot see how Oracle expects that to work for people.
Again, you should be able to create Phase 2 entries with your cloud subnet as remote and your local subnet(s) as local.
-
I agree with you, since I have configured others tunnels with different suppliers to Oracle without use that requirement, but I saw some intermittencies.
Thank you,
Ernani
