Problems with IPsec vpn between pfSense and Oracle Cloud Infrastructure

[Derelict]

Site-to-site tunnels to 0.0.0.0/0 will catch all traffic from the source network including traffic to the internet. I would not recommend doing that, and it is doubtful Oracle cloud IPsec requires it.

If the networks in your Phase 2 are the problem, that will show in the IPsec logs. Check the log settings )VPN> IPsec, Advanced) and be sure that IKE SA, IKE Child SA, and Configuration Backend are set to Diag. Everything else can be Control.

Look at where it is failing and compare with this:

https://www.netgate.com/docs/pfsense/vpn/ipsec/ipsec-troubleshooting.html

Or, of course, you can post the logs here.

When you create a new IPSec connection, you specify a list of IPv4 networks that should be routed from your dynamic routing gateway (DRG) through the IPSec tunnel to your CPE.

Right. All of those routed networks should be specified as Local Networks in Phase 2 entries on your side. The Cloud CIDR should be the Remote Network for all of them.

[RodrigoCBraga]

LogPart1
LogPart2
LogPart3
LogPart4
LogPart5
LogPart6
IPSEC
IPSEC RULES
NATOUTBOUND
RULES WAN
STATE FILTER
STATIC RULES

My set up.
I hope you can help me.
Thanks.

[Derelict]

Delete any static routes you added like that 10.72.0.0/16 to 192.168.1.1. That is not how IPsec works.

Honestly, it looks like your IPsec is doing what you asked it to do. Need to find out why the host in the cloud (10.72.112.30) isn't responding or why your traffic isn't coming back. That's more of an oracle question.

[RodrigoCBraga]

This post is deleted!

[RodrigoCBraga]

I have a doubt.
In pfsense it is possible to do configuration where in phase 2 has the network 0.0.0.0/0 as local and remote?
Attached, screen with configuration between Palo Alto firewall and Oracle Cloud Infrastructure.
Palo Alto Phase 2

[RodrigoCBraga]

@derelict
Hello, can you still help me?

[Derelict]

Help how?

[RodrigoCBraga]

@derelict said in Problems with IPsec vpn between pfSense and Oracle Cloud Infrastructure:

Help how?
Yes.

I have a doubt.
In pfsense it is possible to do configuration where in phase 2 has the network 0.0.0.0/0 as local and remote?
Attached, screen with configuration between Palo Alto firewall and Oracle Cloud Infrastructure.
Palo Alto Phase 2

[Ernani]

@derelict

Hello, I would like to ask your attention to verify Oracle documentation and to comment that Pfsense is compatible and support Oracle VPNAAS.
1 - Oracle documentation to a Generic CPE:
https://docs.cloud.oracle.com/iaas/Content/Network/Reference/genericCPE.htm

Requirements for generic CPE devices are:

local=0.0.0.0/0
remote=0.0.0.0/0
service=any

Please let us know your thoughts about that.

Regards,
Ernani

[Derelict]

Personal opinion:

I think that is completely uncalled for.

On pfSense that will catch all traffic and send it over the tunnel unless extreme measures are taken to bypass it. And there is no way to bypass traffic from the firewall itself.

I cannot see how Oracle expects that to work for people.

Again, you should be able to create Phase 2 entries with your cloud subnet as remote and your local subnet(s) as local.

[Ernani]

@derelict

I agree with you, since I have configured others tunnels with different suppliers to Oracle without use that requirement, but I saw some intermittencies.

Thank you,
Ernani