IPPSEC Tunnel Phase 2 NAT doesn't work



  • Hi,
    I've created a new IPSEC Tunnel
    Phase 1 is connected without no problems, NAT-T is set to auto
    phase 2 is using NAT/BINAT translation to a single IP address,
    I can see that phase 2 is connected in the IPSEC status page.

    Side B is seeing the traffic i'm generating, the issue is that side B is seeing my private local network IP address instead of the NAT/BINAT translation address, although it is configured to translate in the phase 2 config.
    For some reason PFSense is not applying NAT on this specific tunnel (other tunnels NAT is working as expected)
    I also tried with several different IP addresses in the NAT.

    What could be the reason for NAT/BINAT translation not to be applied?
    How can I further troubleshoot this issue?

    2.4.4-RELEASE-p2 (amd64)
    built on Wed Dec 12 07:40:18 EST 2018
    FreeBSD 11.2-RELEASE-p6

    • Moshe


  • Issue resolved,
    It seems that AES-256 doesn't translate NAT/BINAT with DH-Group 2
    I changed the DH-Group to 14 and the issue solved.


Log in to reply