After upgrade to 2.5.0 IpSec connect button is not working

mcury

@jimp said in After upgrade to 2.5.0 IpSec connect button is not working:

https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html

Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
Thanks for the efforts that Netgate is doing to solve the problems.

jimp

@mcury said in After upgrade to 2.5.0 IpSec connect button is not working:

@jimp said in After upgrade to 2.5.0 IpSec connect button is not working:

https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html

Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
Thanks for the efforts that Netgate is doing to solve the problems.

It should be, yes. I'm running 21.02.2 on two SG-3100 units here and thus far haven't had any major issues.

francescouk

@jimp

Yes, defined gateway
follow:
https://ip/status_ipsec.php?act=connect&ikeid=8

jimp

Is it VTI or tunnel mode?

What does its connection block in /var/etc/ipsec/swanctl.conf look like?

jimp

And you didn't say whether or not it has anything in the logs when you click it

francescouk

@jimp swanctl.zip

jimp

That file couldn't have come from an RC image, are you sure you upgraded to 2.1.5 RC?

francescouk

@jimp When I click the connect button does not say anything on the logs using:

tail -f /var/log/ipsec.log | grep XXX.XXX.XXX.XXX

francescouk

@jimp

jimp

The problem is likely that all the child SA entries have overlapping names (e.g. a bunch are con0, con1, etc and don't have proper names. I don't see how that can happen on the RC image unless something else altered the code (like maybe you reverted a previously applied patch after upgrading). It was fixed by https://redmine.pfsense.org/issues/11487 at least any case I've been able to replicate is fixed.

I can't replicate what you are seeing here but if there is a lingering issue it could be from something else in your config. If you can attach a copy of the <ipsec> section of your config.xml (with private stuff redacted) that may help.

But first make sure you didn't revert anything in the system patches package.

francescouk

@jimp config.zip

jimp

I put in some dummy addresses and loaded that into a 2.5.1 RC VM and on mine, the config looks right, and the connect button works.

I'm not quite sure what state your system is in but it's very questionable.

swanctl.conf.txt

francescouk

@jimp Can you at least point me how to solve this problem? Should reinstall? Or anything that could result in sucess??

Before upgrade to RC version, I had applied all the patches:

ead6515637a34ce6e170e2d2b0802e4fa1e63a00 #11435
57beb9ad8ca11703778fc483c7cba0f6770657ac #11435
10eb04259fd139c62e08df8de877b71fdd0eedc8 #11442
ded7970ba57a99767e08243103e55d8a58edfc35 #11486
afffe759c4fd19fe6b8311196f4b6d5e288ea4fb #11487
2fe5cc52bd881ed26723a81e0eed848fd505fba6 #11488

But the ipsec status widget wasn´t working, the connect button also wasn´t working.. so I dunno

francescouk

@jimp For some reason now when I click on connect button it start showing connection:

francescouk

@jimp The other thing I just find out. The screen for the ipsec connections that´s working is different than the new ones. Follow:

Ipsec Config Working:

Ipsec Config NOT Working:

As you can see, the screen is different on Expiration Item

jimp

The difference between those screenshots is the IKE version (IKEv1 vs Auto), the missing field is only valid for IKEv2 (and Auto can use IKEv2). It's not likely to be related to any problem you are seeing.