• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Multiple Phase2 Issues

Scheduled Pinned Locked Moved IPsec
2 Posts 2 Posters 2.2k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    mphilli7823
    last edited by Nov 18, 2016, 9:31 PM

    So I was setting up a tunnel with multiple phase2's, 89 to be exact. After getting all the phase2's setup I noticed the tunnel started to fail with the below error messages:

    11/17/2016 10:59:57 PM 172.16.225.128 [NET] <con1000|8>received packet: from x.x.x.x[500] to x.x.x.x[500] (108 bytes) charon: 11-17 22:59:56 6 09 3
    11/17/2016 10:59:55 PM 172.16.225.128 [IKE] <con1000|8>no matching CHILD_SA config found charon: 11-17 22:59:54 6 09 3
    11/17/2016 10:59:55 PM 172.16.225.128 [ENC] <con1000|8>parsed QUICK_MODE request 974274314 [ HASH SA No KE ID ID ] charon: 11-17 22:59:54 6 09 3
    11/17/2016 10:59:55 PM 172.16.225.128 [NET] <con1000|8>received packet: from x.x.x.x[500] to x.x.x.x[500] (316 bytes) charon: 11-17 22:59:54 6 09 3
    11/17/2016 10:59:55 PM 172.16.225.128 [IKE] <con1000|8>no matching CHILD_SA config found charon: 11-17 22:59:54 6 03 3
    11/17/2016 10:59:55 PM 172.16.225.128 [ENC] <con1000|8>parsed QUICK_MODE request 2918427321 [ HASH SA No KE ID ID ] charon: 11-17 22:59:54 6 03 3
    11/17/2016 10:59:55 PM 172.16.225.128 [NET] <con1000|8>received packet: from x.x.x.x[500] to x.x.x.x[500] (316 bytes) charon: 11-17 22:59:54 6 03 3

    Initially I was using version 2.2.5, so I decided to see if upgrading to the latest release would fix the issue. So I upgraded to version 2.3.2, but the problem still persisted. After more testing, it seems somewhere after adding between 20 and 40 P2's is when the problem occurs. The endpoint vpn device in this case was a palo alto.

    Has anyone seen this kind of behavior before? What can I possibly do to troubleshoot?

    It seems like another user was having a similar issue here, but no one has offered any advice.
    https://forum.pfsense.org/index.php?topic=120940.0</con1000|8></con1000|8></con1000|8></con1000|8></con1000|8></con1000|8></con1000|8>

    1 Reply Last reply Reply Quote 0
    • D
      Derelict LAYER 8 Netgate
      last edited by Nov 18, 2016, 11:22 PM

      Setting IKE SA, IKE Child SA, and Configuration Backend from Control to Diag in VPN > IPsec, Advanced should give you more information in those logs.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      2 out of 2
      • First post
        2/2
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
        This community forum collects and processes your personal information.
        consent.not_received