<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Tunel IPSEC]]></title><description><![CDATA[<p dir="auto">Boa tarde pessoal.<br />
Estou tentando fechar um tunel IPSEC entre 2 empresas, em meus testes (usando VMWARE) funciona de boa com as configurações básicas, acontece que ao utilizar essas mesmas configurações em produção, o link não fecha nenhuma vez. Minhas Configurações são:</p>
<p dir="auto">LADO 1<br />
Ip dinamico pfsense 2.2.5 conectado por pppoe<br />
LAN 192.178.10.1</p>
<p dir="auto">Fase 1<br />
Negotiation - Main<br />
Encryption algorithm - AES 256<br />
Hash Algorithm - SHA1<br />
DH key group - 2</p>
<p dir="auto">Phase2<br />
remote network 192.168.0.0/16<br />
ESP - AES AUTO<br />
Hash - SHA1<br />
PFS - off</p>
<p dir="auto">segundo lado igual porem utilizando minha rede 192.178.10.0/24</p>
<p dir="auto">Configuração do PFsense no lado 2<br />
LAN 192.168.2.254 (DHCP do 192.168.1.1 a 192.168.2.10)</p>
<p dir="auto">Esse lado o servidor está atras de um modem Draytek que faz um balanceamento de rede.<br />
Nesse servidor tambem já existe uma VPN IPSEC ativa com um modem roteador draytek em um outro lado.</p>
<p dir="auto">Nos logs ficam assim:</p>
<p dir="auto">Jul 15 16:41:44 charon 16[CFG] added configuration 'bypasslan'<br />
Jul 15 16:41:44 charon 14[CFG] received stroke: route 'bypasslan'<br />
Jul 15 16:41:44 ipsec_starter 35550 'bypasslan' shunt PASS policy installed<br />
Jul 15 16:41:44 charon 08[CFG] received stroke: add connection 'con1000'<br />
Jul 15 16:41:44 charon 08[CFG] added configuration 'con1000'<br />
Jul 15 16:41:44 charon 06[CFG] received stroke: route 'con1000'<br />
Jul 15 16:41:44 ipsec_starter 35550 'con1000' routed<br />
Jul 15 16:42:00 charon 14[CFG] received stroke: terminate 'con1000'<br />
Jul 15 16:42:00 charon 14[CFG] no IKE_SA named 'con1000' found<br />
Jul 15 16:42:00 charon 10[CFG] received stroke: initiate 'con1000'<br />
Jul 15 16:42:00 charon 09[IKE] &lt;con1000|1&gt;initiating Main Mode IKE_SA con1000[1] to xxx.xxx.xxx.xxx<br />
Jul 15 16:42:00 charon 09[ENC] &lt;con1000|1&gt;generating ID_PROT request 0 [ SA V V V V V ]<br />
Jul 15 16:42:00 charon 09[NET] &lt;con1000|1&gt;sending packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (180 bytes)<br />
Jul 15 16:42:00 charon 09[NET] &lt;con1000|1&gt;received packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (180 bytes)<br />
Jul 15 16:42:00 charon 09[ENC] &lt;con1000|1&gt;parsed ID_PROT response 0 [ SA V V V V V ]<br />
Jul 15 16:42:00 charon 09[IKE] &lt;con1000|1&gt;received XAuth vendor ID<br />
Jul 15 16:42:00 charon 09[IKE] &lt;con1000|1&gt;received DPD vendor ID<br />
Jul 15 16:42:00 charon 09[IKE] &lt;con1000|1&gt;received Cisco Unity vendor ID<br />
Jul 15 16:42:00 charon 09[IKE] &lt;con1000|1&gt;received FRAGMENTATION vendor ID<br />
Jul 15 16:42:00 charon 09[IKE] &lt;con1000|1&gt;received NAT-T (RFC 3947) vendor ID<br />
Jul 15 16:42:00 charon 09[ENC] &lt;con1000|1&gt;generating ID_PROT request 0 [ KE No NAT-D NAT-D ]<br />
Jul 15 16:42:00 charon 09[NET] &lt;con1000|1&gt;sending packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (244 bytes)<br />
Jul 15 16:42:00 charon 09[NET] &lt;con1000|1&gt;received packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (244 bytes)<br />
Jul 15 16:42:00 charon 09[ENC] &lt;con1000|1&gt;parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]<br />
Jul 15 16:42:00 charon 09[IKE] &lt;con1000|1&gt;local host is behind NAT, sending keep alives<br />
Jul 15 16:42:00 charon 09[IKE] &lt;con1000|1&gt;remote host is behind NAT<br />
Jul 15 16:42:00 charon 09[ENC] &lt;con1000|1&gt;generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]<br />
Jul 15 16:42:00 charon 09[NET] &lt;con1000|1&gt;sending packet: from xxx.xxx.xxx.xxx[4500] to xxx.xxx.xxx.xxx[4500] (108 bytes)<br />
Jul 15 16:42:00 charon 16[NET] &lt;con1000|1&gt;received packet: from xxx.xxx.xxx.xxx[4500] to xxx.xxx.xxx.xxx[4500] (92 bytes)<br />
Jul 15 16:42:00 charon 16[ENC] &lt;con1000|1&gt;parsed INFORMATIONAL_V1 request 29414898 [ HASH N(AUTH_FAILED) ]<br />
Jul 15 16:42:00 charon 16[IKE] &lt;con1000|1&gt;received AUTHENTICATION_FAILED error notify<br />
Jul 15 16:42:59 charon 08[NET] &lt;2&gt; received packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (200 bytes)<br />
Jul 15 16:42:59 charon 08[ENC] &lt;2&gt; parsed ID_PROT request 0 [ SA V V V V V V ]<br />
Jul 15 16:42:59 charon 08[IKE] &lt;2&gt; received XAuth vendor ID<br />
Jul 15 16:42:59 charon 08[IKE] &lt;2&gt; received DPD vendor ID<br />
Jul 15 16:42:59 charon 08[IKE] &lt;2&gt; received Cisco Unity vendor ID<br />
Jul 15 16:42:59 charon 08[IKE] &lt;2&gt; received FRAGMENTATION vendor ID<br />
Jul 15 16:42:59 charon 08[IKE] &lt;2&gt; received NAT-T (RFC 3947) vendor ID<br />
Jul 15 16:42:59 charon 08[IKE] &lt;2&gt; received draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br />
Jul 15 16:42:59 charon 08[IKE] &lt;2&gt; xxx.xxx.xxx.xxx is initiating a Main Mode IKE_SA<br />
Jul 15 16:42:59 charon 08[ENC] &lt;2&gt; generating ID_PROT response 0 [ SA V V V V ]<br />
Jul 15 16:42:59 charon 08[NET] &lt;2&gt; sending packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (160 bytes)<br />
Jul 15 16:43:00 charon 08[NET] &lt;2&gt; received packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (244 bytes)<br />
Jul 15 16:43:00 charon 08[ENC] &lt;2&gt; parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]<br />
Jul 15 16:43:00 charon 08[IKE] &lt;2&gt; local host is behind NAT, sending keep alives<br />
Jul 15 16:43:00 charon 08[IKE] &lt;2&gt; remote host is behind NAT<br />
Jul 15 16:43:00 charon 08[ENC] &lt;2&gt; generating ID_PROT response 0 [ KE No NAT-D NAT-D ]<br />
Jul 15 16:43:00 charon 08[NET] &lt;2&gt; sending packet: from xxx.xxx.xxx.xxx[500] to xxx.xxx.xxx.xxx[500] (244 bytes)<br />
Jul 15 16:43:20 charon 14[IKE] &lt;2&gt; sending keep alive to xxx.xxx.xxx.xxx[500]<br />
Jul 15 16:43:30 charon 10[JOB] &lt;2&gt; deleting half open IKE_SA after timeout</p>
<p dir="auto">Será que alguem que já tenha passado por isso possa me dar uma luz??&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;&lt;/con1000|1&gt;</p>
]]></description><link>https://forum.netgate.com/topic/102863/tunel-ipsec</link><generator>RSS for Node</generator><lastBuildDate>Wed, 22 Apr 2026 23:37:17 GMT</lastBuildDate><atom:link href="https://forum.netgate.com/topic/102863.rss" rel="self" type="application/rss+xml"/><pubDate>Fri, 15 Jul 2016 19:53:39 GMT</pubDate><ttl>60</ttl></channel></rss>