Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    IKE algorithm not matching in backup HA node

    IPsec
    1
    1
    345
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gesture1968 last edited by

      Hi,

      Having a 2-node cluster and about 30 Site-2-Site VPN connections, after a failover from the primary to the backup node, only about 5 S2S connections are active, while all others are in connecting mode. I've looked at the IPSec log and what strikes me is that all failing connections get the following error:

      May 31 08:58:20 charon 05[IKE] <6547>  x.x.x.x is initiating a Main Mode IKE_SA
      May 31 08:58:20 charon 05[CFG] <6547> received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
      May 31 08:58:20 charon 05[CFG] <6547> configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
      May 31 08:58:20 charon 05[IKE] <6547> no proposal found

      It's the bold lines that are not correct, as all connections ARE configured using AES256, but somehow the backup node thinks that it is configured using AES128…!? I've doublechecked and all connections are configured as AES256. The primary node is configured this way, so because of the HA, the backup has the same config, and the primary is connecting fine after it's up again and resuming it's primary role. It's just the backup node that is incorrectly assuming a different phase1 AES algorithm. Can this be a bug?

      I'm using PFsense 2.3.1_1

      Greetings,
      Gesture

      1 Reply Last reply Reply Quote 0
      • First post
        Last post