IPsec configuration files lost after reboot.

[artemis]

Ok so how can i ensure that i have setup it correctly and it will be able to start the service its own.

[jimp]

Use the GUI to set it up, and have at least one enabled P1+P2, the rest should happen naturally.

Unless you are making manual modifications or trying to do something the GUI doesn't support, you shouldn't have to take any special steps here.

[artemis]

But the configuration came from the gui. Enabling mobile clients phase 1 + phase 2 and last l2tp. Thats it. When i am restarting the vm i issue the command ipsec status and nothing is appear. Clearly something is worng.

[Konstanti]

@artemis Hay
To help you answer the questions
Sorry for my English

1. during PF booting there is a message "Configuring IPsec VPN...done" ?
2. After booting there is in the /var/etc/ipsec/ file strongswan.conf ?
3. IFCONFIG shows that there is an enc0 interface after booting?

[artemis]

@Konstanti Hello and thank you for your reply.

1. It shows that the IPsec VTI interface is done( Nothing about IPsec VPN and i saw the L2TP vpn configured ok)
   2)There is no ipsec folder inside etc :( (It shows the l2tp but not the ipsec)
   3)Yes there is an enc0 after booting.

[Konstanti]

@artemis enc0 UP or DOWN ?? after booting

[artemis]

It seems to be down.

[Konstanti]

@artemis This means that IPSEC is not enabled at boot time

Or missing phase 1
Or phase 1 is disabled

[artemis]

This post is deleted!

[Konstanti]

@konstanti Try to set IKEV2without the l2tp/IPSEC
From the documentation
We strongly recommend using another solution such as IKEv2 instead of L2TP/IPsec.

[artemis]

[Konstanti]

@artemis Unfortunately, nothing is visible

[Konstanti]

@artemis https://www.netgate.com/docs/pfsense/book/ipsec/mobile-ipsec.html

[artemis]

Ok. To describe it, am showing you that the phase1 is enabled from the gui and the interface is not up.

[Konstanti]

@artemis
When booting the PF checks whether it is enabled to initialize IPSEC
If not , enc0 set to down
And files strongswan.conf, ipsec.conf,..... not created

Try to configure access using IKEV2 without l2tp

[artemis]

Ok how can i say to my pfsense to check the IPsec on the boot, because as i told you before it doesnt check it. My remote hosts do not support ikev2

[Konstanti]

@artemis he picture shows that phase 1 is disabled from gui (your configuration)
Phase 1 is enabled (my configuration)

[artemis]

Right now i am feeling that i want to dig a hole and put myself in. I thought that green (Enabled) was the status of the phase 1. Omg and the worst part is that i am a network engineer(CCNP). OMG. Thank you very much.

[Grimson]

@artemis said in IPsec configuration files lost after reboot.:

I thought that green (Enabled) was the status of the phase 1.

There is a big difference between Enable and Enabled.

[artemis]

Just a comment to say something Grimson?