Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Multiple Phase2 Issues

    IPsec
    2
    2
    1986
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mphilli7823 last edited by

      So I was setting up a tunnel with multiple phase2's, 89 to be exact. After getting all the phase2's setup I noticed the tunnel started to fail with the below error messages:

      11/17/2016 10:59:57 PM 172.16.225.128 [NET] <con1000|8>received packet: from x.x.x.x[500] to x.x.x.x[500] (108 bytes) charon: 11-17 22:59:56 6 09 3
      11/17/2016 10:59:55 PM 172.16.225.128 [IKE] <con1000|8>no matching CHILD_SA config found charon: 11-17 22:59:54 6 09 3
      11/17/2016 10:59:55 PM 172.16.225.128 [ENC] <con1000|8>parsed QUICK_MODE request 974274314 [ HASH SA No KE ID ID ] charon: 11-17 22:59:54 6 09 3
      11/17/2016 10:59:55 PM 172.16.225.128 [NET] <con1000|8>received packet: from x.x.x.x[500] to x.x.x.x[500] (316 bytes) charon: 11-17 22:59:54 6 09 3
      11/17/2016 10:59:55 PM 172.16.225.128 [IKE] <con1000|8>no matching CHILD_SA config found charon: 11-17 22:59:54 6 03 3
      11/17/2016 10:59:55 PM 172.16.225.128 [ENC] <con1000|8>parsed QUICK_MODE request 2918427321 [ HASH SA No KE ID ID ] charon: 11-17 22:59:54 6 03 3
      11/17/2016 10:59:55 PM 172.16.225.128 [NET] <con1000|8>received packet: from x.x.x.x[500] to x.x.x.x[500] (316 bytes) charon: 11-17 22:59:54 6 03 3

      Initially I was using version 2.2.5, so I decided to see if upgrading to the latest release would fix the issue. So I upgraded to version 2.3.2, but the problem still persisted. After more testing, it seems somewhere after adding between 20 and 40 P2's is when the problem occurs. The endpoint vpn device in this case was a palo alto.

      Has anyone seen this kind of behavior before? What can I possibly do to troubleshoot?

      It seems like another user was having a similar issue here, but no one has offered any advice.
      https://forum.pfsense.org/index.php?topic=120940.0</con1000|8></con1000|8></con1000|8></con1000|8></con1000|8></con1000|8></con1000|8>

      1 Reply Last reply Reply Quote 0
      • Derelict
        Derelict LAYER 8 Netgate last edited by

        Setting IKE SA, IKE Child SA, and Configuration Backend from Control to Diag in VPN > IPsec, Advanced should give you more information in those logs.

        Chattanooga, Tennessee, USA
        The pfSense Book is free of charge!
        DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • First post
          Last post