<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Pfsense 2.4.x to USG ipsec issues]]></title><description><![CDATA[<p dir="auto">Trying to tackle this from both sides (im using tunnels, not VTI)</p>
<p dir="auto">I am able to get the initial site to site working, but after about an hour I will lose the ipsec connection (the phase 2 drops but phase 1 stays up) until I reboot the ipsec service on the pfsense (or on the USG side).  Currently running 2.4.4.a.20180902.2216</p>
<p dir="auto">If I look up the ipsec status on the pfsense I can see phase 1 established but after an hour, I see phase 2 drop off.</p>
<p dir="auto">On the USG side:</p>
<p dir="auto">running strongSwan 5.2.2</p>
<p dir="auto">Sep  4 06:25:13 16[KNL] creating acquire job for policy 10.100.200.1/32[udp/46118] === 172.16.44.31/32[udp/syslog] with reqid {1}<br />
Sep  4 06:25:13 15[IKE] &lt;peer-x.x.x.57-tunnel-0|3&gt; establishing CHILD_SA peer-x.x.x.57-tunnel-0{1}<br />
Sep  4 06:27:58 03[KNL] creating delete job for ESP CHILD_SA with SPI cc4d3605 and reqid {1}</p>
<p dir="auto">From the USG side, rekeying is having issues</p>
<p dir="auto">09[KNL] creating rekey job for ESP CHILD_SA with SPI c9e601a9 and reqid {1}<br />
09[IKE] establishing CHILD_SA peer-x.x.x.57-tunnel-0{1}<br />
09[ENC] generating CREATE_CHILD_SA request 0 [ N(REKEY_SA) SA No TSi TSr ]<br />
09[NET] sending packet: from x.x.x..179[500] to x.x.x.57[500] (204 bytes)<br />
03[NET] received packet: from x.x.x.57[500] to x.x.x..179[500] (76 bytes)<br />
03[ENC] parsed CREATE_CHILD_SA response 0 [ N(NO_PROP) ]<br />
03[IKE] received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built<br />
03[IKE] failed to establish CHILD_SA, keeping IKE_SA</p>
<p dir="auto">PFsense side:</p>
<p dir="auto"><strong>Waiting for the phase2 to drop off again and will post here</strong></p>
<p dir="auto">I am looking for advice on where to go next when it comes to troubleshooting this phase 2 issue between the pfsense box and USG</p>
]]></description><link>https://forum.netgate.com/topic/134923/pfsense-2-4-x-to-usg-ipsec-issues</link><generator>RSS for Node</generator><lastBuildDate>Tue, 06 Oct 2026 09:56:54 GMT</lastBuildDate><atom:link href="https://forum.netgate.com/topic/134923.rss" rel="self" type="application/rss+xml"/><pubDate>Tue, 04 Sep 2018 11:07:03 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to Pfsense 2.4.x to USG ipsec issues on Wed, 05 Sep 2018 10:52:54 GMT]]></title><description><![CDATA[<p dir="auto">https://www.synology.com/en-us/knowledgebase/SRM/tutorial/VPN/How_to_set_up_Site_to_Site_VPN_between_Synology_Router_and_UniFi_SG</p>
<p dir="auto">Based on the article above, the settings below seem to be stable on both sides so far</p>
<p dir="auto">Phase 1:<br />
Encryption: AES128<br />
Authentication: SHA1<br />
Key life: 14400<br />
DH Group: 14 (modp 2048)<br />
DPD (Dead Peer Detection): disable</p>
<p dir="auto">Phase 2:<br />
Encryption: AES128<br />
Authentication: SHA1<br />
Key life: 14400<br />
DH Group: 14 (modp 2048)</p>
<p dir="auto">The only thing on the USG side is selecting Enable Perfect Forward Secrecy (PFS) checkbox.</p>
<p dir="auto"><strong>Update</strong></p>
<p dir="auto">Been up for 19 hours solid</p>
]]></description><link>https://forum.netgate.com/post/787301</link><guid isPermaLink="true">https://forum.netgate.com/post/787301</guid><dc:creator><![CDATA[pfsenseuser1]]></dc:creator><pubDate>Wed, 05 Sep 2018 10:52:54 GMT</pubDate></item></channel></rss>