Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    IPPSEC Tunnel Phase 2 NAT doesn't work

    IPsec
    1
    2
    96
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      moshikoy last edited by

      Hi,
      I've created a new IPSEC Tunnel
      Phase 1 is connected without no problems, NAT-T is set to auto
      phase 2 is using NAT/BINAT translation to a single IP address,
      I can see that phase 2 is connected in the IPSEC status page.

      Side B is seeing the traffic i'm generating, the issue is that side B is seeing my private local network IP address instead of the NAT/BINAT translation address, although it is configured to translate in the phase 2 config.
      For some reason PFSense is not applying NAT on this specific tunnel (other tunnels NAT is working as expected)
      I also tried with several different IP addresses in the NAT.

      What could be the reason for NAT/BINAT translation not to be applied?
      How can I further troubleshoot this issue?

      2.4.4-RELEASE-p2 (amd64)
      built on Wed Dec 12 07:40:18 EST 2018
      FreeBSD 11.2-RELEASE-p6

      • Moshe
      1 Reply Last reply Reply Quote 0
      • M
        moshikoy last edited by

        Issue resolved,
        It seems that AES-256 doesn't translate NAT/BINAT with DH-Group 2
        I changed the DH-Group to 14 and the issue solved.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post