IPSec connection established and trafic is outgoing, but no ongoing response

[lmhaydii]

@konstanti thank you for your response. I don't think is an IPSec configuration issue. We have already a IPSec tunnel (using pfsense 2.1.5) with the same third party and same configuration and it's working fine.

[Konstanti]

@lmhaydii if the packets reach 192.168.127.80 and do not return, you should look for the problem in cisco
Show the output of commands
show crypto map
show crypto ipsec sa
show ip route

[Konstanti]

@lmhaydii I would disable NAT / BINAT on the Pfsense side

[lmhaydii]

@konstanti our local subnet 192.168.50.0/24 is already used in thier system, so I'm obligated to use a NAT / BITNAT option.

[Konstanti]

@lmhaydii OK
often more problems are due to MSS
Try reducing it on the cisco side to 1360
https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html#anc16

[lmhaydii]

@konstanti They did the debugging on their part and they confirm that the answer is back to me

[Konstanti]

@lmhaydii
Pfsense ipsec settings
VPN/IPSEC/Advanced

[lmhaydii]

@konstanti Alredy tried, but not working :/

[Konstanti]

@lmhaydii and ping passes between hosts ?

[Konstanti]

@lmhaydii You can still see what's going on using the packet capture.
Diagnostics/Packet Capture
Interface IPSEC
and show here what happens at the moment of connection

[lmhaydii]

@konstanti No ping, no telnet. Telnet reach thiier server but i can't get thier response back.
When I do a telnet, pckets captured are :
12:50:05.113719 (authentic,confidential): SPI 0xc5431e8c: IP 192.168.50.12.44276 > 192.168.127.80.8082: tcp 0
12:50:06.117304 (authentic,confidential): SPI 0xc5431e8c: IP 192.168.50.12.44276 > 192.168.127.80.8082: tcp 0
12:50:08.133382 (authentic,confidential): SPI 0xc5431e8c: IP 192.168.50.12.44276 > 192.168.127.80.8082: tcp 0

And Diagnostic > States are :

Packets Bytes
LAN tcp 192.168.50.12:44274 -> 192.168.127.80:8082 CLOSED:SYN_SENT 3 / 0 180 B / 0 B
IPsec tcp 192.168.113.12:44274 (192.168.50.12:44274) -> 192.168.127.80:8082 SYN_SENT:CLOSED 3 / 0 180 B / 0 B

[Konstanti]

@lmhaydii The solution to the problem should be sought from Cisco side
Ip packets in its party leave and do not return

[Konstanti]

@lmhaydii
Here's what it looks like to me
15:59:50.636268 (authentic,confidential): SPI 0xc4b93af1: IP XX.XXX.70.141 > XX.XXX.236.39: GREv0, length 174: IP 192.168.1.96.51731 > 208.123.73.199.443: tcp 118
15:59:50.856954 (authentic,confidential): SPI 0xc8365d06: IP XX.XXX.236.39 > XX.XXX.70.141: GREv0, length 56: IP 208.123.73.199.443 > 192.168.1.96.51731: tcp 0

[lmhaydii]

@konstanti Thank you for your help, I will try from another server without NAT / BITANT and see if that will work

[lmhaydii]

Hi again,
After several attempts, I come back to you, maybe I can find a solution.
I tried several configurations, but still the same issue : Tunnel connexion establisheed, telnet request go out, but can't catch the response. The responder server guys confirm that they are getting my requests and they return a response. But the response is lost somehwere and I can't determine where !
I've tried all pfsense log level on IPSec advenced options : but found nothing that can help, except when setting Kernel Interface on highest I can see :
(

This is a resume of my debbuging:
the tunnel is up and request are going out :

The connexion states are closed !

Packet captures with 0 bytes !

And netstat with 0 packet error !

[Derelict]

If the reply is not arriving on your IPsec interface there is nothing you can do about it. They have to fix it on their side.

[Konstanti]

@lmhaydii

Tcp 0 is the SYN packet to establish the connection, this is normal .
The bad thing is that the answer is not from the second side
It is necessary to deal with the second side
Ask them to show the answer log
Can they ping your host 192.168.50.11 ?
Can you ping their host 192.168.127.80 ?

[lmhaydii]

@derelict thank you. How can I determine with certitude that thier response or thier request are not arriving to my firewall ? There is any command to show up that ?

[lmhaydii]

@konstanti No they can't ping my host.
but my ping requests arrive to thier side, but I can't get any response from them

[Konstanti]

@lmhaydii
/diagnostics/packet capture /
interface wan
host - static ip address of second side
protocol esp
start
as a result , you should see if the answers come from the second host or not?
aaaa -> bbbb (esp)
bbbb-> aaaa(esp)
.....

In order for them to ping your host , a allow rule must be created on the ipsec interface