Multiple Phase2 Issues
-
So I was setting up a tunnel with multiple phase2's, 89 to be exact. After getting all the phase2's setup I noticed the tunnel started to fail with the below error messages:
11/17/2016 10:59:57 PM 172.16.225.128 [NET] <con1000|8>received packet: from x.x.x.x[500] to x.x.x.x[500] (108 bytes) charon: 11-17 22:59:56 6 09 3
11/17/2016 10:59:55 PM 172.16.225.128 [IKE] <con1000|8>no matching CHILD_SA config found charon: 11-17 22:59:54 6 09 3
11/17/2016 10:59:55 PM 172.16.225.128 [ENC] <con1000|8>parsed QUICK_MODE request 974274314 [ HASH SA No KE ID ID ] charon: 11-17 22:59:54 6 09 3
11/17/2016 10:59:55 PM 172.16.225.128 [NET] <con1000|8>received packet: from x.x.x.x[500] to x.x.x.x[500] (316 bytes) charon: 11-17 22:59:54 6 09 3
11/17/2016 10:59:55 PM 172.16.225.128 [IKE] <con1000|8>no matching CHILD_SA config found charon: 11-17 22:59:54 6 03 3
11/17/2016 10:59:55 PM 172.16.225.128 [ENC] <con1000|8>parsed QUICK_MODE request 2918427321 [ HASH SA No KE ID ID ] charon: 11-17 22:59:54 6 03 3
11/17/2016 10:59:55 PM 172.16.225.128 [NET] <con1000|8>received packet: from x.x.x.x[500] to x.x.x.x[500] (316 bytes) charon: 11-17 22:59:54 6 03 3Initially I was using version 2.2.5, so I decided to see if upgrading to the latest release would fix the issue. So I upgraded to version 2.3.2, but the problem still persisted. After more testing, it seems somewhere after adding between 20 and 40 P2's is when the problem occurs. The endpoint vpn device in this case was a palo alto.
Has anyone seen this kind of behavior before? What can I possibly do to troubleshoot?
It seems like another user was having a similar issue here, but no one has offered any advice.
https://forum.pfsense.org/index.php?topic=120940.0</con1000|8></con1000|8></con1000|8></con1000|8></con1000|8></con1000|8></con1000|8> -
Setting IKE SA, IKE Child SA, and Configuration Backend from Control to Diag in VPN > IPsec, Advanced should give you more information in those logs.
