Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec tunnel - No traffic

    Scheduled Pinned Locked Moved IPsec
    49 Posts 7 Posters 14.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      The SADs will only appear once the tunnel is up. The SPDs should be be there whether it is up or not though.

      If you see no SADs it's not establishing. Check the ipsec logs.

      Steve

      1 Reply Last reply Reply Quote 0
      • M
        Markadaca
        last edited by

        con2000: #3 toOffice pu.bl.ic.ip 10.xx.xx.xx NAT-T re.mo.te.ip re.mo.te.ip IKEv2
        initiator 23725 seconds (06:35:25) AES_CBC
        HMAC_SHA1_96
        PRF_HMAC_SHA1
        MODP_1024 ESTABLISHED
        4026 seconds (01:07:06) ago

        Status shows as "ESTABLISHED" for the main tunnel.

        log snippet:
        Nov 8 18:28:26 charon 09[NET] <con2000|3> received packet: from re.mo.te.ip[4500] to 10.xx.xx.1[4500] (76 bytes)
        Nov 8 18:28:26 charon 09[ENC] <con2000|3> parsed INFORMATIONAL request 252 [ ]
        Nov 8 18:28:26 charon 09[ENC] <con2000|3> generating INFORMATIONAL response 252 [ ]
        Nov 8 18:28:26 charon 09[NET] <con2000|3> sending packet: from 10.xx.xx.1[4500] to re.mo.te.ip[4500] (76 bytes)
        Nov 8 18:28:30 charon 12[CFG] vici client 574 connected
        Nov 8 18:28:30 charon 16[CFG] vici client 574 registered for: list-sa
        Nov 8 18:28:30 charon 16[CFG] vici client 574 requests: list-sas
        Nov 8 18:28:30 charon 16[CFG] vici client 574 disconnected

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          You want to look for log messages detailing bringing up the ESP inner tunnels based on the traffic selectors.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          M 1 Reply Last reply Reply Quote 0
          • M
            Markadaca @Derelict
            last edited by

            @derelict How do I do that? I'm in Status -> System Logs -> System -> General
            what would I filter by?

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Look on the IPSec tab there. Errors will likely be evident just by reading it unless you have a few IPSec tunnels in which case they may be lost in the logging from that. Try restarting the problem tunnel and then immediately checking the IPSec log again.

              Look for phase 2 issues such as those shown here:
              https://www.netgate.com/docs/pfsense/vpn/ipsec/ipsec-troubleshooting.html#phase-2-network-mismatch

              Steve

              1 Reply Last reply Reply Quote 0
              • M
                Markadaca
                last edited by

                Thanks, it was a phase 2 no acceptable ENCRYPTION_ALGORITHM found message
                Mismatched AES128 on one side and AES256 on the other.

                Sorry for the thread-jack, I'll go away now.

                1 Reply Last reply Reply Quote 0
                • B
                  bpados
                  last edited by

                  I'm not seeing phase2 related errors.
                  1_1541785064291_2018-11-09 12_34_21-GW1- Status_ System Logs_ IPsec.png 0_1541785064290_2018-11-09 12_28_11-GW1- Status_ IPsec_ Overview.png

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    That is all dead peer detection.

                    Your Phase 2 looks like it is coming up.

                    Obfuscating the private addresses makes it almost impossible to help you. Nobody cares what your private addresses are.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • B
                      bpados
                      last edited by

                      Phase 2 been coming up for weeks now.
                      0_1541786318274_2018-11-09 12_56_22-GW1- Status_ IPsec_ Overview.png

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Ok, so where are you actually sending traffic from?

                        Does pfSense have an IP in 192.168.27.0/24? If so try sending some pings to any address in 192.168.97.0/24 from Diag > Ping using the 192.168.27.0/24 interfaces as the source. Those should definitely appear in the traffic counter as outbound packets even if there are no replies.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • B
                          bpados
                          last edited by

                          from 192.168.27.1 to 192.168.97.1 No traffic is showing/passing on IPSEC.

                          PING 192.168.97.1 (192.168.97.1): 56 data bytes

                          --- 192.168.97.1 ping statistics ---
                          10 packets transmitted, 0 packets received, 100.0% packet loss

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            You didn't select a source interface as I said otherwise it would show that. That traffic won't go over the VPN unless the source IP matching the local subnet selector.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • B
                              bpados
                              last edited by

                              Sorry Steve. I did overlook that request.

                              PING 192.168.97.50 (192.168.97.50) from 192.168.27.1: 56 data bytes

                              --- 192.168.97.50 ping statistics ---
                              10 packets transmitted, 0 packets received, 100.0% packet loss

                              1 Reply Last reply Reply Quote 0
                              • GrimsonG
                                Grimson Banned
                                last edited by

                                Might be a shot into the dark, but what are your firewall rules for IPsec? Did you add rules for the new tunnels?

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by stephenw10

                                  Ok so that target may not respond to pings or is blocked etc but did you see 10 packets on the Phase 2 status outbound?

                                  Traffic from the firewall itself should always be allowed out across the tunnel. Unless you have specific blocking 'OUT' floating rules.

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    bpados
                                    last edited by

                                    at this point for testing I have a very open rule set on both ends.
                                    As for traffic It doesn't even display the phase2 for ipsec tunnels

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Your screenshot above shows the Phase 2 as established but the traffic counters show 0 packets in or out. After running that ping it should show 10 packets out.

                                      Steve

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        bpados
                                        last edited by

                                        I know but it doesn't.

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          Please run the ping test again and post another shot of Status > IPsec with the phase 2 expanded. Thanks.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          S 1 Reply Last reply Reply Quote 0
                                          • S
                                            sgw @Derelict
                                            last edited by sgw

                                            @derelict
                                            another thread-hijacker here:
                                            I see issues on a tunnel between my 2.4.4 SG-1000 and a remote SG-3100 on 2.4.3-p1 still.

                                            tunnel comes up, no traffic goes through .. no ping via shell, nothing seen in Status page.

                                            disabled that new async-option, checked and upgraded strongswan (on SG-1000), re-saved tunnel configs, restarted IPSEC ... I will disable other tunnels and check back with a screenshot or so.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.