After upgrade to 2.5.0 IpSec connect button is not working
-
Hi there,
After upgrade my pfsense to 2.5.0 the ipsec connect button does not work anymore. Anyone having the same problem?
-
It's a known issue:
https://redmine.pfsense.org/issues/11486Fixed in the upcoming release.
-
@jimp Thatยดs the thing. Even applying the pactch, I still cannot connect manually. The only thing that happens is that the page reload after clicking on the connect button and thatยดs it.
-
You may also be affected by one of the other related bugs, it might not be the connect button at all but the way the connection block is written in the config.
Best thing to do at this point is to upgrade from 2.5.0 to the 2.5.1 RC snapshot and try it there.
-
@jimp Do you have a procedure for upgrading?
-
-
@jimp I can confirm that after the upgrade, the problem still persist. I cannot make the tunnel to connect manually.
-
Do you see anything in the IPsec logs when you click the button?
If you right click the button and copy the URL, what are the parameters? (e.g.
status_ipsec.php?act=connect&ikeid=1
)And what kind of tunnel is it? Does it have a defined remote gateway address or is using something like an FQDN or maybe
0.0.0.0/0
/%any
? -
@jimp said in After upgrade to 2.5.0 IpSec connect button is not working:
https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html
Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
Thanks for the efforts that Netgate is doing to solve the problems. -
@mcury said in After upgrade to 2.5.0 IpSec connect button is not working:
@jimp said in After upgrade to 2.5.0 IpSec connect button is not working:
https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html
Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
Thanks for the efforts that Netgate is doing to solve the problems.It should be, yes. I'm running 21.02.2 on two SG-3100 units here and thus far haven't had any major issues.
-
Yes, defined gateway
follow:
https://ip/status_ipsec.php?act=connect&ikeid=8 -
Is it VTI or tunnel mode?
What does its connection block in
/var/etc/ipsec/swanctl.conf
look like? -
And you didn't say whether or not it has anything in the logs when you click it
-
-
That file couldn't have come from an RC image, are you sure you upgraded to 2.1.5 RC?
-
@jimp When I click the connect button does not say anything on the logs using:
tail -f /var/log/ipsec.log | grep XXX.XXX.XXX.XXX
-
-
The problem is likely that all the child SA entries have overlapping names (e.g. a bunch are
con0
,con1
, etc and don't have proper names. I don't see how that can happen on the RC image unless something else altered the code (like maybe you reverted a previously applied patch after upgrading). It was fixed by https://redmine.pfsense.org/issues/11487 at least any case I've been able to replicate is fixed.I can't replicate what you are seeing here but if there is a lingering issue it could be from something else in your config. If you can attach a copy of the
<ipsec>
section of your config.xml (with private stuff redacted) that may help.But first make sure you didn't revert anything in the system patches package.
-
-
I put in some dummy addresses and loaded that into a 2.5.1 RC VM and on mine, the config looks right, and the connect button works.
I'm not quite sure what state your system is in but it's very questionable.