IPSec tunnel - No traffic

[Derelict]

You want to look for log messages detailing bringing up the ESP inner tunnels based on the traffic selectors.

[Markadaca]

@derelict How do I do that? I'm in Status -> System Logs -> System -> General
what would I filter by?

[stephenw10]

Look on the IPSec tab there. Errors will likely be evident just by reading it unless you have a few IPSec tunnels in which case they may be lost in the logging from that. Try restarting the problem tunnel and then immediately checking the IPSec log again.

Look for phase 2 issues such as those shown here:
https://www.netgate.com/docs/pfsense/vpn/ipsec/ipsec-troubleshooting.html#phase-2-network-mismatch

Steve

[Markadaca]

Thanks, it was a phase 2 no acceptable ENCRYPTION_ALGORITHM found message
Mismatched AES128 on one side and AES256 on the other.

Sorry for the thread-jack, I'll go away now.

[bpados]

I'm not seeing phase2 related errors.

[Derelict]

That is all dead peer detection.

Your Phase 2 looks like it is coming up.

Obfuscating the private addresses makes it almost impossible to help you. Nobody cares what your private addresses are.

[bpados]

Phase 2 been coming up for weeks now.

[stephenw10]

Ok, so where are you actually sending traffic from?

Does pfSense have an IP in 192.168.27.0/24? If so try sending some pings to any address in 192.168.97.0/24 from Diag > Ping using the 192.168.27.0/24 interfaces as the source. Those should definitely appear in the traffic counter as outbound packets even if there are no replies.

Steve

[bpados]

from 192.168.27.1 to 192.168.97.1 No traffic is showing/passing on IPSEC.

PING 192.168.97.1 (192.168.97.1): 56 data bytes

--- 192.168.97.1 ping statistics ---
10 packets transmitted, 0 packets received, 100.0% packet loss

[stephenw10]

You didn't select a source interface as I said otherwise it would show that. That traffic won't go over the VPN unless the source IP matching the local subnet selector.

Steve

[bpados]

Sorry Steve. I did overlook that request.

PING 192.168.97.50 (192.168.97.50) from 192.168.27.1: 56 data bytes

--- 192.168.97.50 ping statistics ---
10 packets transmitted, 0 packets received, 100.0% packet loss

[Grimson]

Might be a shot into the dark, but what are your firewall rules for IPsec? Did you add rules for the new tunnels?

[stephenw10]

Ok so that target may not respond to pings or is blocked etc but did you see 10 packets on the Phase 2 status outbound?

Traffic from the firewall itself should always be allowed out across the tunnel. Unless you have specific blocking 'OUT' floating rules.

Steve

[bpados]

at this point for testing I have a very open rule set on both ends.
As for traffic It doesn't even display the phase2 for ipsec tunnels

[stephenw10]

Your screenshot above shows the Phase 2 as established but the traffic counters show 0 packets in or out. After running that ping it should show 10 packets out.

Steve

[bpados]

I know but it doesn't.

[Derelict]

Please run the ping test again and post another shot of Status > IPsec with the phase 2 expanded. Thanks.

[sgw]

@derelict
another thread-hijacker here:
I see issues on a tunnel between my 2.4.4 SG-1000 and a remote SG-3100 on 2.4.3-p1 still.

tunnel comes up, no traffic goes through .. no ping via shell, nothing seen in Status page.

disabled that new async-option, checked and upgraded strongswan (on SG-1000), re-saved tunnel configs, restarted IPSEC ... I will disable other tunnels and check back with a screenshot or so.

[Derelict]

If you know you're hijacking why not just start another thread?

[sgw]

@derelict said in IPSec tunnel - No traffic:

If you know you're hijacking why not just start another thread?

because it might be the same issue/bug and it will be easier to search for that ... ? sorry