After upgrade to 2.5.0 IpSec connect button is not working

francescouk

Hi there,

After upgrade my pfsense to 2.5.0 the ipsec connect button does not work anymore. Anyone having the same problem?

jimp

It's a known issue:
https://redmine.pfsense.org/issues/11486

Fixed in the upcoming release.

francescouk

@jimp That´s the thing. Even applying the pactch, I still cannot connect manually. The only thing that happens is that the page reload after clicking on the connect button and that´s it.

jimp

You may also be affected by one of the other related bugs, it might not be the connect button at all but the way the connection block is written in the config.

Best thing to do at this point is to upgrade from 2.5.0 to the 2.5.1 RC snapshot and try it there.

francescouk

@jimp Do you have a procedure for upgrading?

jimp

https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html

francescouk

@jimp I can confirm that after the upgrade, the problem still persist. I cannot make the tunnel to connect manually.

jimp

Do you see anything in the IPsec logs when you click the button?

If you right click the button and copy the URL, what are the parameters? (e.g. status_ipsec.php?act=connect&ikeid=1)

And what kind of tunnel is it? Does it have a defined remote gateway address or is using something like an FQDN or maybe 0.0.0.0/0/%any?

mcury

@jimp said in After upgrade to 2.5.0 IpSec connect button is not working:

https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html

Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
Thanks for the efforts that Netgate is doing to solve the problems.

jimp

@mcury said in After upgrade to 2.5.0 IpSec connect button is not working:

@jimp said in After upgrade to 2.5.0 IpSec connect button is not working:

https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html

Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
Thanks for the efforts that Netgate is doing to solve the problems.

It should be, yes. I'm running 21.02.2 on two SG-3100 units here and thus far haven't had any major issues.

francescouk

@jimp

Yes, defined gateway
follow:
https://ip/status_ipsec.php?act=connect&ikeid=8

jimp

Is it VTI or tunnel mode?

What does its connection block in /var/etc/ipsec/swanctl.conf look like?

jimp

And you didn't say whether or not it has anything in the logs when you click it

francescouk

@jimp swanctl.zip

jimp

That file couldn't have come from an RC image, are you sure you upgraded to 2.1.5 RC?

francescouk

@jimp When I click the connect button does not say anything on the logs using:

tail -f /var/log/ipsec.log | grep XXX.XXX.XXX.XXX

francescouk

@jimp

jimp

The problem is likely that all the child SA entries have overlapping names (e.g. a bunch are con0, con1, etc and don't have proper names. I don't see how that can happen on the RC image unless something else altered the code (like maybe you reverted a previously applied patch after upgrading). It was fixed by https://redmine.pfsense.org/issues/11487 at least any case I've been able to replicate is fixed.

I can't replicate what you are seeing here but if there is a lingering issue it could be from something else in your config. If you can attach a copy of the <ipsec> section of your config.xml (with private stuff redacted) that may help.

But first make sure you didn't revert anything in the system patches package.

francescouk

@jimp config.zip

jimp

I put in some dummy addresses and loaded that into a 2.5.1 RC VM and on mine, the config looks right, and the connect button works.

I'm not quite sure what state your system is in but it's very questionable.

swanctl.conf.txt