Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec tunnel - No traffic

    Scheduled Pinned Locked Moved IPsec
    49 Posts 7 Posters 14.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Markadaca
      last edited by

      con2000: #3 toOffice pu.bl.ic.ip 10.xx.xx.xx NAT-T re.mo.te.ip re.mo.te.ip IKEv2
      initiator 23725 seconds (06:35:25) AES_CBC
      HMAC_SHA1_96
      PRF_HMAC_SHA1
      MODP_1024 ESTABLISHED
      4026 seconds (01:07:06) ago

      Status shows as "ESTABLISHED" for the main tunnel.

      log snippet:
      Nov 8 18:28:26 charon 09[NET] <con2000|3> received packet: from re.mo.te.ip[4500] to 10.xx.xx.1[4500] (76 bytes)
      Nov 8 18:28:26 charon 09[ENC] <con2000|3> parsed INFORMATIONAL request 252 [ ]
      Nov 8 18:28:26 charon 09[ENC] <con2000|3> generating INFORMATIONAL response 252 [ ]
      Nov 8 18:28:26 charon 09[NET] <con2000|3> sending packet: from 10.xx.xx.1[4500] to re.mo.te.ip[4500] (76 bytes)
      Nov 8 18:28:30 charon 12[CFG] vici client 574 connected
      Nov 8 18:28:30 charon 16[CFG] vici client 574 registered for: list-sa
      Nov 8 18:28:30 charon 16[CFG] vici client 574 requests: list-sas
      Nov 8 18:28:30 charon 16[CFG] vici client 574 disconnected

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        You want to look for log messages detailing bringing up the ESP inner tunnels based on the traffic selectors.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        M 1 Reply Last reply Reply Quote 0
        • M
          Markadaca @Derelict
          last edited by

          @derelict How do I do that? I'm in Status -> System Logs -> System -> General
          what would I filter by?

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Look on the IPSec tab there. Errors will likely be evident just by reading it unless you have a few IPSec tunnels in which case they may be lost in the logging from that. Try restarting the problem tunnel and then immediately checking the IPSec log again.

            Look for phase 2 issues such as those shown here:
            https://www.netgate.com/docs/pfsense/vpn/ipsec/ipsec-troubleshooting.html#phase-2-network-mismatch

            Steve

            1 Reply Last reply Reply Quote 0
            • M
              Markadaca
              last edited by

              Thanks, it was a phase 2 no acceptable ENCRYPTION_ALGORITHM found message
              Mismatched AES128 on one side and AES256 on the other.

              Sorry for the thread-jack, I'll go away now.

              1 Reply Last reply Reply Quote 0
              • B
                bpados
                last edited by

                I'm not seeing phase2 related errors.
                1_1541785064291_2018-11-09 12_34_21-GW1- Status_ System Logs_ IPsec.png 0_1541785064290_2018-11-09 12_28_11-GW1- Status_ IPsec_ Overview.png

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  That is all dead peer detection.

                  Your Phase 2 looks like it is coming up.

                  Obfuscating the private addresses makes it almost impossible to help you. Nobody cares what your private addresses are.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • B
                    bpados
                    last edited by

                    Phase 2 been coming up for weeks now.
                    0_1541786318274_2018-11-09 12_56_22-GW1- Status_ IPsec_ Overview.png

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Ok, so where are you actually sending traffic from?

                      Does pfSense have an IP in 192.168.27.0/24? If so try sending some pings to any address in 192.168.97.0/24 from Diag > Ping using the 192.168.27.0/24 interfaces as the source. Those should definitely appear in the traffic counter as outbound packets even if there are no replies.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • B
                        bpados
                        last edited by

                        from 192.168.27.1 to 192.168.97.1 No traffic is showing/passing on IPSEC.

                        PING 192.168.97.1 (192.168.97.1): 56 data bytes

                        --- 192.168.97.1 ping statistics ---
                        10 packets transmitted, 0 packets received, 100.0% packet loss

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          You didn't select a source interface as I said otherwise it would show that. That traffic won't go over the VPN unless the source IP matching the local subnet selector.

                          Steve

                          1 Reply Last reply Reply Quote 0
                          • B
                            bpados
                            last edited by

                            Sorry Steve. I did overlook that request.

                            PING 192.168.97.50 (192.168.97.50) from 192.168.27.1: 56 data bytes

                            --- 192.168.97.50 ping statistics ---
                            10 packets transmitted, 0 packets received, 100.0% packet loss

                            1 Reply Last reply Reply Quote 0
                            • GrimsonG
                              Grimson Banned
                              last edited by

                              Might be a shot into the dark, but what are your firewall rules for IPsec? Did you add rules for the new tunnels?

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by stephenw10

                                Ok so that target may not respond to pings or is blocked etc but did you see 10 packets on the Phase 2 status outbound?

                                Traffic from the firewall itself should always be allowed out across the tunnel. Unless you have specific blocking 'OUT' floating rules.

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • B
                                  bpados
                                  last edited by

                                  at this point for testing I have a very open rule set on both ends.
                                  As for traffic It doesn't even display the phase2 for ipsec tunnels

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Your screenshot above shows the Phase 2 as established but the traffic counters show 0 packets in or out. After running that ping it should show 10 packets out.

                                    Steve

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      bpados
                                      last edited by

                                      I know but it doesn't.

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        Please run the ping test again and post another shot of Status > IPsec with the phase 2 expanded. Thanks.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        S 1 Reply Last reply Reply Quote 0
                                        • S
                                          sgw @Derelict
                                          last edited by sgw

                                          @derelict
                                          another thread-hijacker here:
                                          I see issues on a tunnel between my 2.4.4 SG-1000 and a remote SG-3100 on 2.4.3-p1 still.

                                          tunnel comes up, no traffic goes through .. no ping via shell, nothing seen in Status page.

                                          disabled that new async-option, checked and upgraded strongswan (on SG-1000), re-saved tunnel configs, restarted IPSEC ... I will disable other tunnels and check back with a screenshot or so.

                                          1 Reply Last reply Reply Quote 0
                                          • DerelictD
                                            Derelict LAYER 8 Netgate
                                            last edited by

                                            If you know you're hijacking why not just start another thread?

                                            Chattanooga, Tennessee, USA
                                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            S 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.