Issue with multiple phase 2
-
i cannot figure out whats going on here. i have 20ish VPNs, most of them have more than 1 phase 2 so as to accomodate multiple vlans (my side and remote side). this has been working fine for literally years, until about a week ago.
now, most of my VPNs will only transmit traffic over 1 phase 2, with all others (no matter if its 1, or more) show something like this:
Bytes-In: 0 (0 B)
Packets-In: 0
Bytes-Out: 100,096 (98 KiB)
Packets-Out: 788the 0 packets in is the tell-tale that the tunnel is up but no traffic is passing.
it seems to be related to my end only. several of my remote endpoints in turn have their own remote sites that have multiple phase 2, and all those are up and working. short of killing my pfsens and starting with a fresh install (ugh…) im not sure what else to do.
any ideas of where i can start, so i can work this issue out?
-
BTW… i have tried deleting the entire tunnel, and then rebuilding phase 1 and all phase 2 on both ends, to no avail. and i see quite a bit of this in my ipsec log:
Nov 10 05:41:25 charon 10[KNL] <con1000|26>unable to query SAD entry with SPI cd7ce05f: No such file or directory (2)
Nov 10 05:41:25 charon 10[KNL] <con6000|29>unable to query SAD entry with SPI c7d59b23: No such file or directory (2)
Nov 10 05:41:25 charon 10[KNL] <con12000|31>unable to query SAD entry with SPI c22321ba: No such file or directory (2)</con12000|31></con6000|29></con1000|26> -
I was having the same issue. I was trying to add multiple phase 2's (89) to be exact to a tunnel and I noticed the tunnel would go down. After further investigation it seems it starts to choke somewhere between 20-40 phase 2's
Did you ever get any traction on this?
-
so far no, i have only noticed this behavior since 2.3 versions.
recently i have deleted the entire phase1/2 and rebuilt, but its the same symptom.
-
What specific pfSense version? What is at each end? IKEv1 or IKEv2? What is the makeup of the phase 2 tunnels in question?
-
derelict, what specific questions about phase 2 items do you want to know about?
i have tried ike1 and 2 and both show same behavior.
the first phase2 will show traffic, but all other phase2 have this symptom:
Bytes-In: 0 (0 B)
Packets-In: 0
Bytes-Out: 16,592 (16 KiB)
Packets-Out: 134 -
That looks like the other side is not sending traffic. Hence my questions about what is on the other side and what the makeup of the phase 2s is. No idea what could be wrong. I would be guessing. Show everything.
