Can't establish VPN tunnel between PFSense & Sonicwall (06.08.17 it works!)

[pfrickroll]

Hi
I need help in understanding what am I doing wrong here. I am still learning all this stuff.
I am trying to build a VPN tunnel from PFSense SG-2220 (2.3.4) to Sonicwall TZ400 (SonicOS Enhanced 6.2.3.1-19n). I successfully was able to do VPN tunnel from Sonicwall to Sonicwall except couple of things but that’s beside the point.

PFsense SG-2220 is connected to Comcast modem CG3000CDR which is in the passive bridge mode or whatever you call it and has static IP. Then I have laptop for testing connected to PFSense which has to use company’s proprietary medical software through VPN.
Sonicwall TZ400 is connected Comcast CMG modem (can’t tell the model right now), and modem is in bridge mode as well. Behind Sonicwall are switches and Windows Server.

Here is what I did and checking logs all I see is that packets are sent and nothing else happens, VPN doesn’t work at all.
The option “Set this option to disable this phase1 without removing it from the list” is always checked, I uncheck it every time but when I get back to settings it is checked again. Why is that? (PFsense1 pic.)
The IKE authentication in red is different from Sonicwall, so I am confused is what exactly I have to choose here, I tried to play around a little but no luck. (PFsense 2 pic.)
As I stated above options for IKE authentication are a bit different from PFSense, so I think here is my main problem.

If I will be able to connect PFSense with Sonicwall then I will be able to set up our doctors to use our proprietary software to access data from our Head Quarters through VPN. I tested to make sure it works when I set up TP-Link router with Cisco router. However; there’s one thing, I need to know is what I had to do after VPN is established, so that computers/servers can see each other on network? As I mentioned I am new to networking but I marked with yellow  (Laptop pic.) what I mean and where they have to see each other. The sonicwall to sonicwall VPN, I can ping both ways, can access server/computer using \x.x.x.x but they don’t see each other on the network. In command prompt I don’t see virtual IPs for VPN…

Thanks and sorry for English mistakes.


[pfrickroll]

Ok, i fixed the pictures

[pfrickroll]

Anyone at all?

[pfrickroll]

I am still with no luck

[dotdash]

@pfrickroll:

I am still with no luck

Perhaps something to do with your username…
Here are a few observations, recommendations-

1. Don't use 3DES, the Sonic will support AES
2. Use main mode on the pfSense side, not aggressive
3. Don't put the public IP in the ping host on the phase2. This should be a private IP reachable via the tunnel.
4. You should be able to leave the identifiers at 'my ip address' and 'peer ip address'
5. Two Comcast lines? They are not at the same location are they?
   6) If the tunnel is disabled, it will never work. Find out why this is happening first. Start your config from scratch if necessary.

[pfrickroll]

@dotdash:

@pfrickroll:

I am still with no luck

Perhaps something to do with your username…
Here are a few observations, recommendations-

1. Don't use 3DES, the Sonic will support AES
2. Use main mode on the pfSense side, not aggressive
3. Don't put the public IP in the ping host on the phase2. This should be a private IP reachable via the tunnel.
4. You should be able to leave the identifiers at 'my ip address' and 'peer ip address'
5. Two Comcast lines? They are not at the same location are they?
   6) If the tunnel is disabled, it will never work. Find out why this is happening first. Start your config from scratch if necessary.

Thank you for your reply. I doubt my name scares people away :)
I changed everything you mentioned in 1-4.
The two lines are Comcast and they are not in the same location. Two separate offices in different cities.
I rebuilt the config from scratch and still nothing. Here you can see, when I click edit phase 1 the check mark is always on "Set this option to disable this phase1 without removing it from the list". The both phases are enabled but only phase 1 has this check mark on. I try to unmark it, save and apply change, then I go back to edit and that mark is checked again.
And of course I changed config settings on SonicWALL to match pfSense.

[dotdash]

@pfrickroll:

I doubt my name scares people away :)

Maybe not scared away…

Something is up with your phase1 settings- It doesn't start disabled, and I've never seen it disable itself.
Post all of your phase1 settings, there must be something it doesn't like. Are you getting any IPSec errors in the log when you try to enable it?

[pfrickroll]

@dotdash:

@pfrickroll:

I doubt my name scares people away :)

Maybe not scared away…

Something is up with your phase1 settings- It doesn't start disabled, and I've never seen it disable itself.
Post all of your phase1 settings, there must be something it doesn't like. Are you getting any IPSec errors in the log when you try to enable it?

Here are my phase 1 settings and IPsec Logs. I first cleared the logs and then disabled IPsec. Then I clicked to edit it, unmarked that disable feature in phase 1, then enabled Ipsec log and this is what info came up in log for IPsec. Now, I even myself noticed both firewalls talked to each other but something went wrong and it beyond my experience, I just began learning of encryption.


[Derelict]

Still pretty tough to tell looking at only one side.

You should probably post a new set of screen shots from both sides showing the current state of things as a pair.

The sonicwall doesn't like something and is returning "INVALID_SYNTAX" in the Phase 1 negotiation. Concentrate on Phase 1/IKE for now since you are not even getting to phase 2. The reason the sonicwall is returning that might be in the sonicwall logs.

Set the following to Diag in VPN > IPsec, Advanced, Logging: IKE SA, IKE CHILD SA, and Configuration Backend. Set everything else to Control.

[dotdash]

Yeah, most of the stuff in the logs is normal until you get to the last shot.
Try setting Key Exchange to V1 instead of Auto.
The syntax error is unusual, I think this is what is disabling the phase1. Try deleting the phase2 and unchecking the disabled box on the phase1. Then verify the service remains running. If that's good, add the phase2 back in.

[pfrickroll]

Set the following to Diag in VPN > IPsec, Advanced, Logging: IKE SA, IKE CHILD SA, and Configuration Backend. Set everything else to Control.

I dont see such option here, everything is set to control by default, as you see in the picture
2nd pictures is Sonicwall logs for that particular time.


[pfrickroll]

Set the following to Diag in VPN > IPsec, Advanced, Logging: IKE SA, IKE CHILD SA, and Configuration Backend. Set everything else to Control.

Ah sorry, my bad English kicked in. Going to change now to Diag those configs.

[Derelict]

Those sonicwall logs don't really say much. I assume they are descending later to earlier in time?

[pfrickroll]

@Derelict:

Those sonicwall logs don't really say much. I assume they are descending later to earlier in time?

No, that is the only info in logs for VPN between these pfSense and Sonicwall. Nothing before or after.

[dotdash]

Looks like pfSense proposed a v2 exchange and the Sonic was set for v1.
Change the auto setting to v1 and try again.

[pfrickroll]

I set those configs to Diag. Here are the logs for IPsec and Sonicwall


[Derelict]

You know you can copy and paste text instead of screen shots of those logs right?

[Derelict]

OK so you're now getting through phase 1. The INVAL_ID error means the networks on your side do not match what the other side has configured.

You have:

Local: 192.168.0.0/16
Remote: 192.168.3.0/24

That /16 is almost certainly wrong and probably will not work.

[pfrickroll]

Ok, so rebuilt pfSense tunnel from scratch again with IKEv1 version and 192.168.10.0/24 subnet

pfSense logs:
May 25 09:56:28  charon  10[IKE] <con1000|1>reinitiating already active tasks 
May 25 09:56:28  charon  10[IKE] <con1000|1>ISAKMP_VENDOR task 
May 25 09:56:28  charon  10[IKE] <con1000|1>MAIN_MODE task 
May 25 09:56:28  charon  10[ENC] <con1000|1>generating ID_PROT request 0 [ KE No NAT-D NAT-D ] 
May 25 09:56:28  charon  10[NET] <con1000|1>sending packet: from pfsense[500] to sonicWall[500] (244 bytes) 
May 25 09:56:28  charon  11[NET] <con1000|1>received packet: from sonicWall[500] to pfsense[500] (276 bytes) 
May 25 09:56:28  charon  11[ENC] <con1000|1>parsed ID_PROT response 0 [ KE NAT-D NAT-D No V V V ] 
May 25 09:56:28  charon  11[ENC] <con1000|1>received unknown vendor ID: 40:4b:f4:39:52:2c:a3:f6 
May 25 09:56:28  charon  11[IKE] <con1000|1>received XAuth vendor ID 
May 25 09:56:28  charon  11[IKE] <con1000|1>received DPD vendor ID 
May 25 09:56:28  charon  11[IKE] <con1000|1>reinitiating already active tasks 
May 25 09:56:28  charon  11[IKE] <con1000|1>ISAKMP_VENDOR task 
May 25 09:56:28  charon  11[IKE] <con1000|1>MAIN_MODE task 
May 25 09:56:28  charon  11[ENC] <con1000|1>generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ] 
May 25 09:56:28  charon  11[NET] <con1000|1>sending packet: from pfsense[500] to SonicWall[500] (108 bytes) 
May 25 09:56:28  charon  08[NET] <con1000|1>received packet: from SonicWall[500] to pfsense[500] (76 bytes) 
May 25 09:56:28  charon  08[ENC] <con1000|1>parsed ID_PROT response 0 [ ID HASH ] 
May 25 09:56:28  charon  08[IKE] <con1000|1>IKE_SA con1000[1] established between pfsense[pfsense]…SonicWall[SonicWall] 
May 25 09:56:28  charon  08[IKE] <con1000|1>IKE_SA con1000[1] state change: CONNECTING => ESTABLISHED 
May 25 09:56:28  charon  08[IKE] <con1000|1>scheduling reauthentication in 28174s 
May 25 09:56:28  charon  08[IKE] <con1000|1>maximum IKE_SA lifetime 28714s 
May 25 09:56:28  charon  08[IKE] <con1000|1>activating new tasks 
May 25 09:56:28  charon  08[IKE] <con1000|1>activating QUICK_MODE task 
May 25 09:56:28  charon  08[CFG] <con1000|1>configured proposals: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ 
May 25 09:56:28  charon  08[CFG] <con1000|1>configured proposals: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ 
May 25 09:56:28  charon  08[CFG] <con1000|1>proposing traffic selectors for us: 
May 25 09:56:28  charon  08[CFG] <con1000|1>192.168.10.0/24|/0 
May 25 09:56:28  charon  08[CFG] <con1000|1>proposing traffic selectors for other: 
May 25 09:56:28  charon  08[CFG] <con1000|1>192.168.3.0/24|/0 
May 25 09:56:28  charon  08[ENC] <con1000|1>generating QUICK_MODE request 4263043729 [ HASH SA No ID ID ] 
May 25 09:56:28  charon  08[NET] <con1000|1>sending packet: from pfsense[500] to SonicWall[500] (188 bytes) 
May 25 09:56:28  charon  07[NET] <con1000|1>received packet: from SonicWall[500] to pfsense[500] (108 bytes) 
May 25 09:56:28  charon  07[ENC] <con1000|1>parsed INFORMATIONAL_V1 request 2520402767 [ HASH N(NO_PROP) ] 
May 25 09:56:28  charon  07[IKE] <con1000|1>received NO_PROPOSAL_CHOSEN error notify 
May 25 09:56:31  charon  00[DMN] signal of type SIGINT received. Shutting down 
May 25 09:56:31  charon  00[IKE] <con1000|1>queueing ISAKMP_DELETE task 
May 25 09:56:31  charon  00[IKE] <con1000|1>activating new tasks 
May 25 09:56:31  charon  00[IKE] <con1000|1>activating ISAKMP_DELETE task 
May 25 09:56:31  charon  00[IKE] <con1000|1>deleting IKE_SA con1000[1] between pfsense[pfsense]…SonicWall[SonicWall] 
May 25 09:56:31  charon  00[IKE] <con1000|1>sending DELETE for IKE_SA con1000[1] 
May 25 09:56:31  charon  00[IKE] <con1000|1>IKE_SA con1000[1] state change: ESTABLISHED => DELETING 
May 25 09:56:31  charon  00[ENC] <con1000|1>generating INFORMATIONAL_V1 request 3586940182 [ HASH D ] 
May 25 09:56:31  charon  00[NET] <con1000|1>sending packet: from pfsense[500] to SonicWall[500] (92 bytes) 
May 25 09:56:31  charon  00[IKE] <con1000|1>IKE_SA con1000[1] state change: DELETING => DESTROYING 
May 25 09:56:31  charon  00[CFG] proposing traffic selectors for us: 
May 25 09:56:31  charon  00[CFG] 192.168.10.0/24|/0 
May 25 09:56:31  charon  00[CFG] proposing traffic selectors for other: 
May 25 09:56:31  charon  00[CFG] 192.168.10.0/24|/0 
May 25 09:56:31  ipsec_starter  42453  charon stopped after 200 ms 
May 25 09:56:31  ipsec_starter  42453  ipsec starter stopped

SonicWall logs:
09:57:40 May 25 403 VPN Inform IKE negotiation aborted due to Timeout sonicwall, 500 pfsense, 500 udp VPN Policy

09:57:06 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK MM (InitCookie:0x7f9802c36a3f9670 RespCookie:0x0000000000000000, MsgID: 0x0) (SA, VID, VID, VID, VID, VID) Sonicwall, 500 pfsense, 500 udp

09:57:06 May 25 930 VPN Inform IKE Initiator: Remote party Timeout - Retransmitting IKE Request. sonicwall, 500 pfsense, 500 udp VPN Policy

09:56:48 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK MM (InitCookie:0x7f9802c36a3f9670 RespCookie:0x0000000000000000, MsgID: 0x0) (SA, VID, VID, VID, VID, VID) sonicwall, 500 pfsense, 500 udp

09:56:48 May 25 930 VPN Inform IKE Initiator: Remote party Timeout - Retransmitting IKE Request. sonicwall, 500 pfsense, 500 udp VPN Policy: VPN

09:56:37 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK MM (InitCookie:0x7f9802c36a3f9670 RespCookie:0x0000000000000000, MsgID: 0x0) (SA, VID, VID, VID, VID, VID) sonicwall, 500 pfsense, 500 udp

09:56:37 May 25 930 VPN Inform IKE Initiator: Remote party Timeout - Retransmitting IKE Request. sonicwall, 500 pfsense, 500 udp VPN Policy: VPN

09:56:31 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK MM (InitCookie:0x7f9802c36a3f9670 RespCookie:0x0000000000000000, MsgID: 0x0) (SA, VID, VID, VID, VID, VID) sonicwall, 500 pfsense, 500 udp
09:56:31 May 25 351 VPN Inform IKE Initiator: Start Main Mode negotiation (Phase 1) sonicwall, 500 pfsense, 500 udp VPN Policy: VPN
to HQ
09:56:31 May 25 413 VPN Inform Received IKE SA delete request pfsense, 500 sonicwall, 500 VPN Policy: VPN
to HQ
09:56:31 May 25 171 VPN Debug RECEIVED<<< ISAKMP OAK INFO (InitCookie:0x0edac780e119a512 RespCookie:0x02d555f9af2c4338, MsgID: 0xD5CC5D16) *(HASH, DEL) pfsense, 500 sonicwall, 500 udp

09:56:28 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK INFO (InitCookie:0x0edac780e119a512 RespCookie:0x02d555f9af2c4338, MsgID: 0x963A4B4F) *(HASH, NOTIFY: NO_PROPOSAL_CHOSEN) sonicwall, pfsense, 500 udp

09:56:28 May 25 171 VPN Debug RECEIVED<<< ISAKMP OAK QM (InitCookie:0x0edac780e119a512 RespCookie:0x02d555f9af2c4338, MsgID: 0xFE18E291) *(HASH, SA, NON, ID, ID) pfsense, 500 sonicwall, 500 udp

09:56:28 May 25 352 VPN Inform IKE Responder: Received Quick Mode Request (Phase 2) pfsense, 500 sonicwall, 500 udp VPN Policy: VPN

09:56:28 May 25 88 VPN Warning IKE Responder: IPsec proposal does not match (Phase 2) pfsense, 500 sonicwall, 500 udp VPN Policy: VPN

09:56:28 May 25 259 VPN Warning IKE Responder: ESP Perfect Forward Secrecy mismatch pfsense, 500 sonicwall, 500 udp VPN Policy: VPN

09:56:28 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK MM (InitCookie:0x0edac780e119a512 RespCookie:0x02d555f9af2c4338, MsgID: 0x0) *(ID, HASH) sonicwall, 500 pfsense, 500 udp

09:56:28 May 25 357 VPN Inform IKE Responder: Main Mode complete (Phase 1) pfsense, 500 sonicwall, 500 VPN Policy: VPN

09:56:28 May 25 241 VPN Inform NAT Discovery : No NAT/NAPT device detected between IPsec Security gateways pfsense, 500 sonicwall, 500 VPN Policy: VPN

09:56:28 May 25 171 VPN Debug RECEIVED<<< ISAKMP OAK MM (InitCookie:0x0edac780e119a512 RespCookie:0x02d555f9af2c4338, MsgID: 0x0) *(ID, HASH, NOTIFY: INITIAL_CONTACT) pfsense, 500 sonicwall, 500 udp

09:56:28 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK MM (InitCookie:0x0edac780e119a512 RespCookie:0x02d555f9af2c4338, MsgID: 0x0) (KE, NATD, NATD, NON, VID, VID, VID) sonicwall, 500 pfsense, 500 udp

09:56:28 May 25 171 VPN Debug RECEIVED<<< ISAKMP OAK MM (InitCookie:0x0edac780e119a512 RespCookie:0x02d555f9af2c4338, MsgID: 0x0) (KE, NON, NATD, NATD) pfsense, 500 sonicwall, 500 udp

09:56:28 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK MM (InitCookie:0x0edac780e119a512 RespCookie:0x02d555f9af2c4338, MsgID: 0x0) (SA, VID, VID) sonicwall, 500 5pfsense, 500 udp

09:56:28 May 25 355 VPN Inform IKE Responder: Received Main Mode Request (Phase 1) pfsense, 500 sonicwall, 500 udp

09:56:28 May 25 171 VPN Debug RECEIVED<<< ISAKMP OAK MM (InitCookie:0x0edac780e119a512 RespCookie:0x0000000000000000, MsgID: 0x0) (SA, VID, VID, VID, VID, VID) pfsense, 500 sonicwall, 500 udp

09:56:24 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK MM (InitCookie:0x26b927c746756b4c RespCookie:0x0000000000000000, MsgID: 0x0) (SA, VID, VID, VID, VID, VID) sonicwall, 500 pfsense, 500 udp

09:56:24 May 25 930 VPN Inform IKE Initiator: Remote party Timeout - Retransmitting IKE Request. sonicwall, 500 pfsense, 500 udp VPN Policy: VPN

09:56:19 May 25 171 VPN Debug SENDING>>>> ISAKMP OAK MM (InitCookie:0x26b927c746756b4c RespCookie:0x0000000000000000, MsgID: 0x0) (SA, VID, VID, VID, VID, VID) sonicwall, 500 pfsense, 500 udp

09:56:19 May 25 351 VPN Inform IKE Initiator: Start Main Mode negotiation (Phase 1) sonicwall, 500 pfsense, 500 udp VPN Policy: VPN

What does it mean in bold? It refers to Comcast modem? Its there just in bridge mode</con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1></con1000|1>

[pfrickroll]

This is pfSense IPsec config, I don't know is there an option to copy/paste short log config of IPsec, so I just screen caped it.