Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Getting hundreds of duplicating Phase2's on IPSEC VTI tunnels to AWS

    Scheduled Pinned Locked Moved IPsec
    3 Posts 2 Posters 232 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      ttblum
      last edited by ttblum

      Hello,

      Starting in the past year, all of my VTI tunnels from my pfSense routers to AWS have been getting intermittent periods of packet loss.

      When the loss is happening I'm noticing hundreds of Phase2's listed for this connection in Status-->IPSec:

      pfsense-vti-ipsec-1.png

      pfsense-ipsec-vti-4.png

      even though I only have 1 Phase2 configured for the tunnel:

      pfsense-ipsec-vti-3.png

      The following is logged over and over:

      Sep 23 14:25:01 myrouter charon: 09[IKE] <con3000|5478> sending DPD request
Sep 23 14:25:01 myrouter charon: 09[ENC] <con3000|5478> generating INFORMATIONAL request 456 [ ]
Sep 23 14:25:01 myrouter charon: 09[NET] <con3000|5478> sending packet: from my.ip.addr.ess[4500] to their.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:01 myrouter charon: 09[NET] <con3000|5478> received packet: from their.ip.addr.ess[4500] to my.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:01 myrouter charon: 09[ENC] <con3000|5478> parsed INFORMATIONAL response 456 [ ]
Sep 23 14:25:02 myrouter charon: 10[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:02 myrouter charon: 10[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:04 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:04 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:07 myrouter charon: 11[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:07 myrouter charon: 11[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:10 myrouter charon: 15[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:10 myrouter charon: 15[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:11 myrouter charon: 01[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:11 myrouter charon: 01[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:11 myrouter charon: 01[IKE] <con3000|5478> sending DPD request
Sep 23 14:25:11 myrouter charon: 01[ENC] <con3000|5478> generating INFORMATIONAL request 457 [ ]
Sep 23 14:25:11 myrouter charon: 01[NET] <con3000|5478> sending packet: from my.ip.addr.ess[4500] to their.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:11 myrouter charon: 01[NET] <con3000|5478> received packet: from their.ip.addr.ess[4500] to my.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:11 myrouter charon: 01[ENC] <con3000|5478> parsed INFORMATIONAL response 457 [ ]
Sep 23 14:25:13 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:13 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:16 myrouter charon: 10[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:16 myrouter charon: 10[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:18 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:18 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:21 myrouter charon: 12[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:21 myrouter charon: 12[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:21 myrouter charon: 12[IKE] <con3000|5478> sending DPD request
Sep 23 14:25:21 myrouter charon: 12[ENC] <con3000|5478> generating INFORMATIONAL request 458 [ ]
Sep 23 14:25:21 myrouter charon: 12[NET] <con3000|5478> sending packet: from my.ip.addr.ess[4500] to their.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:21 myrouter charon: 12[NET] <con3000|5478> received packet: from their.ip.addr.ess[4500] to my.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:21 myrouter charon: 12[ENC] <con3000|5478> parsed INFORMATIONAL response 458 [ ]
Sep 23 14:25:22 myrouter charon: 11[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:22 myrouter charon: 11[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:28 myrouter charon: 13[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:28 myrouter charon: 13[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:28 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:28 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:31 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:31 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:31 myrouter charon: 09[IKE] <con3000|5478> sending DPD request
Sep 23 14:25:31 myrouter charon: 09[ENC] <con3000|5478> generating INFORMATIONAL request 459 [ ]
Sep 23 14:25:31 myrouter charon: 09[NET] <con3000|5478> sending packet: from my.ip.addr.ess[4500] to their.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:31 myrouter charon: 09[NET] <con3000|5478> received packet: from their.ip.addr.ess[4500] to my.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:31 myrouter charon: 09[ENC] <con3000|5478> parsed INFORMATIONAL response 459 [ ]
Sep 23 14:25:33 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:33 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:34 myrouter charon: 08[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:34 myrouter charon: 08[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:38 myrouter charon: 14[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:38 myrouter charon: 14[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:40 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:40 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:41 myrouter charon: 13[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:41 myrouter charon: 13[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:41 myrouter charon: 13[IKE] <con3000|5478> sending DPD request

      I'm running 2.4.5-RELEASE .

      Has anyone else seen anything like this?

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        https://redmine.pfsense.org/issues/10176

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • T
          ttblum
          last edited by

          OK, thanks.

          As far as I can tell, the suggested settings are:

          Enable 'Make-before-break' (VPN-->IPSec-->Advanced Settings tab) on both sides

          • OR -

          Disable reauthentication and enable rekey -
          Version 2.5.0: Leave reauth blank and put a value in rekey
          Version 2.4.5: Check 'Disable Reauth'. Leave 'Disable Rekey' unchecked
          On one side, Check 'Responder Only', and set 'Child SA Close Action' to 'Close/Clear'
          On the other side, set 'Child SA close action' to 'Restart/Reconnect'

          This patch would need to be applied to allow VTI tunnels to be set to Responder Only

          Is this correct?

          How would I apply these settings to an IPSec tunnel to AWS?

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.