VPN S2S - P2 Bytes-In: 0 (0 B) Packets-In: 0 Bytes-Out: 0 (0 B) Packets-Out: 0

[jonathan.posada]

Good day,

My problem is in a vpn that had been working well around a year ago (No changes have been made in the last days that affect the behavior of this connection).

Today I have no connection to the addresses I have configured in the respective phases 2 of a vpn I have against a fortigate, to review I changed the lifetime in both phase 1 and phase 2 but the result is the same.

The vpn lifts but the state of the 15 phases 2 that I have configured is the following.

Bytes-In: 0 (0 B) Packets-In: 0 Bytes-Out: 0 (0 B) Packets-Out: 0

Well the question is if before it worked because no longer, as I said I see that phase 1 rises without problems equally phases 2 but these do not generate traffic input and output (This ever happened to me the brief solution was to disconnect the tunnel and upload it again), but today this solution without coherence had no effect.

Version 2.4.4-RELEASE-p1
Config

Well for my part I would say that there are no problems in the configuration because as I mentioned this worked without problem and hard stable and never presented this problem, your help I have already invested in forums some people with the same problem but none gives a solution.

making a capture from the fortinet the traffic comes out but in the pfsense even with the vpn up there is no traffic for phases 2

[Derelict]

Not sure what you're expecting there. 172.16.100.6 is not a local subnet in any of the Phase 2 entries you showed us.

[jonathan.posada]

@derelict Good day thanks for answering this is the p2 is configured, as I was saying this before it worked today stages 2 in a capture is not seen traffic.

[Derelict]

OK so we assume that P2 is actually up.

If you packet capture on the IPsec interface and those SYNs do not arrive, the problem is likely on the fortigate side.

Do you see traffic or increasing counters for traffic originating on your side?

[jonathan.posada]

@derelict from the firewall fortigate in the capture I see the traffic coming out, but this does not reach the pfsense making the capture by ipsec

Origin -> fortigate
192.168.0.0/24
destination -> pfsense
172.16.100.0/27

Something additional currently from that fortigate I have another vpn with another pfsense and it is established without problems these two vpn have the same configuration parameters.