1. Home
  2. pfSense® Software
  3. IPsec
  4. Getting hundreds of duplicating Phase2's on IPSEC VTI tunnels to AWS

Getting hundreds of duplicating Phase2's on IPSEC VTI tunnels to AWS

  • T

    Hello,

    Starting in the past year, all of my VTI tunnels from my pfSense routers to AWS have been getting intermittent periods of packet loss.

    When the loss is happening I'm noticing hundreds of Phase2's listed for this connection in Status-->IPSec:

    pfsense-vti-ipsec-1.png

    pfsense-ipsec-vti-4.png

    even though I only have 1 Phase2 configured for the tunnel:

    pfsense-ipsec-vti-3.png

    The following is logged over and over:

    Sep 23 14:25:01 myrouter charon: 09[IKE] <con3000|5478> sending DPD request
Sep 23 14:25:01 myrouter charon: 09[ENC] <con3000|5478> generating INFORMATIONAL request 456 [ ]
Sep 23 14:25:01 myrouter charon: 09[NET] <con3000|5478> sending packet: from my.ip.addr.ess[4500] to their.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:01 myrouter charon: 09[NET] <con3000|5478> received packet: from their.ip.addr.ess[4500] to my.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:01 myrouter charon: 09[ENC] <con3000|5478> parsed INFORMATIONAL response 456 [ ]
Sep 23 14:25:02 myrouter charon: 10[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:02 myrouter charon: 10[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:04 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:04 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:07 myrouter charon: 11[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:07 myrouter charon: 11[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:10 myrouter charon: 15[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:10 myrouter charon: 15[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:11 myrouter charon: 01[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:11 myrouter charon: 01[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:11 myrouter charon: 01[IKE] <con3000|5478> sending DPD request
Sep 23 14:25:11 myrouter charon: 01[ENC] <con3000|5478> generating INFORMATIONAL request 457 [ ]
Sep 23 14:25:11 myrouter charon: 01[NET] <con3000|5478> sending packet: from my.ip.addr.ess[4500] to their.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:11 myrouter charon: 01[NET] <con3000|5478> received packet: from their.ip.addr.ess[4500] to my.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:11 myrouter charon: 01[ENC] <con3000|5478> parsed INFORMATIONAL response 457 [ ]
Sep 23 14:25:13 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:13 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:16 myrouter charon: 10[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:16 myrouter charon: 10[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:18 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:18 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:21 myrouter charon: 12[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:21 myrouter charon: 12[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:21 myrouter charon: 12[IKE] <con3000|5478> sending DPD request
Sep 23 14:25:21 myrouter charon: 12[ENC] <con3000|5478> generating INFORMATIONAL request 458 [ ]
Sep 23 14:25:21 myrouter charon: 12[NET] <con3000|5478> sending packet: from my.ip.addr.ess[4500] to their.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:21 myrouter charon: 12[NET] <con3000|5478> received packet: from their.ip.addr.ess[4500] to my.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:21 myrouter charon: 12[ENC] <con3000|5478> parsed INFORMATIONAL response 458 [ ]
Sep 23 14:25:22 myrouter charon: 11[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:22 myrouter charon: 11[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:28 myrouter charon: 13[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:28 myrouter charon: 13[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:28 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:28 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:31 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:31 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:31 myrouter charon: 09[IKE] <con3000|5478> sending DPD request
Sep 23 14:25:31 myrouter charon: 09[ENC] <con3000|5478> generating INFORMATIONAL request 459 [ ]
Sep 23 14:25:31 myrouter charon: 09[NET] <con3000|5478> sending packet: from my.ip.addr.ess[4500] to their.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:31 myrouter charon: 09[NET] <con3000|5478> received packet: from their.ip.addr.ess[4500] to my.ip.addr.ess[4500] (80 bytes)
Sep 23 14:25:31 myrouter charon: 09[ENC] <con3000|5478> parsed INFORMATIONAL response 459 [ ]
Sep 23 14:25:33 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:33 myrouter charon: 09[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:34 myrouter charon: 08[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:34 myrouter charon: 08[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:38 myrouter charon: 14[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:38 myrouter charon: 14[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:40 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:40 myrouter charon: 06[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found
Sep 23 14:25:41 myrouter charon: 13[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:41 myrouter charon: 13[KNL] <con3000|5478> querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
Sep 23 14:25:41 myrouter charon: 13[IKE] <con3000|5478> sending DPD request

    I'm running 2.4.5-RELEASE .

    Has anyone else seen anything like this?

    0
  • jimp
    Rebel Alliance Developer Netgate

    https://redmine.pfsense.org/issues/10176

    0
  • T

    OK, thanks.

    As far as I can tell, the suggested settings are:

    Enable 'Make-before-break' (VPN-->IPSec-->Advanced Settings tab) on both sides

    • OR -

    Disable reauthentication and enable rekey -
    Version 2.5.0: Leave reauth blank and put a value in rekey
    Version 2.4.5: Check 'Disable Reauth'. Leave 'Disable Rekey' unchecked
    On one side, Check 'Responder Only', and set 'Child SA Close Action' to 'Close/Clear'
    On the other side, set 'Child SA close action' to 'Restart/Reconnect'

    This patch would need to be applied to allow VTI tunnels to be set to Responder Only

    Is this correct?

    How would I apply these settings to an IPSec tunnel to AWS?

    0
Log in to reply
 

Products

Services

Support

News

Resources

Company

Our Mission

We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

Subscribe to our Newsletter

Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

© 2020 Rubicon Communications, LLC | Privacy Policy