Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    After upgrade to 2.5.0 IpSec connect button is not working

    Scheduled Pinned Locked Moved IPsec
    24 Posts 3 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      francescouk
      last edited by

      Hi there,

      After upgrade my pfsense to 2.5.0 the ipsec connect button does not work anymore. Anyone having the same problem?

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        It's a known issue:
        https://redmine.pfsense.org/issues/11486

        Fixed in the upcoming release.

        Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        F 1 Reply Last reply Reply Quote 1
        • F
          francescouk @jimp
          last edited by

          @jimp Thatยดs the thing. Even applying the pactch, I still cannot connect manually. The only thing that happens is that the page reload after clicking on the connect button and thatยดs it.

          jimpJ 1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate @francescouk
            last edited by

            You may also be affected by one of the other related bugs, it might not be the connect button at all but the way the connection block is written in the config.

            Best thing to do at this point is to upgrade from 2.5.0 to the 2.5.1 RC snapshot and try it there.

            Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            F 1 Reply Last reply Reply Quote 1
            • F
              francescouk @jimp
              last edited by

              @jimp Do you have a procedure for upgrading?

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html

                Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                F M 2 Replies Last reply Reply Quote 2
                • F
                  francescouk @jimp
                  last edited by francescouk

                  @jimp I can confirm that after the upgrade, the problem still persist. I cannot make the tunnel to connect manually.

                  1 Reply Last reply Reply Quote 0
                  • jimpJ
                    jimp Rebel Alliance Developer Netgate
                    last edited by jimp

                    Do you see anything in the IPsec logs when you click the button?

                    If you right click the button and copy the URL, what are the parameters? (e.g. status_ipsec.php?act=connect&ikeid=1)

                    And what kind of tunnel is it? Does it have a defined remote gateway address or is using something like an FQDN or maybe 0.0.0.0/0/%any?

                    Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    F 1 Reply Last reply Reply Quote 1
                    • M
                      mcury @jimp
                      last edited by

                      @jimp said in After upgrade to 2.5.0 IpSec connect button is not working:

                      https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html

                      Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
                      Thanks for the efforts that Netgate is doing to solve the problems.

                      dead on arrival, nowhere to be found.

                      jimpJ 1 Reply Last reply Reply Quote 0
                      • jimpJ
                        jimp Rebel Alliance Developer Netgate @mcury
                        last edited by

                        @mcury said in After upgrade to 2.5.0 IpSec connect button is not working:

                        @jimp said in After upgrade to 2.5.0 IpSec connect button is not working:

                        https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html

                        Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
                        Thanks for the efforts that Netgate is doing to solve the problems.

                        It should be, yes. I'm running 21.02.2 on two SG-3100 units here and thus far haven't had any major issues.

                        Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                        Need help fast? Netgate Global Support!

                        Do not Chat/PM for help!

                        1 Reply Last reply Reply Quote 1
                        • F
                          francescouk @jimp
                          last edited by francescouk

                          @jimp

                          Yes, defined gateway
                          follow:
                          https://ip/status_ipsec.php?act=connect&ikeid=8

                          628dc70d-11b3-466d-a5cb-27b3cf66159f-image.png

                          1 Reply Last reply Reply Quote 0
                          • jimpJ
                            jimp Rebel Alliance Developer Netgate
                            last edited by

                            Is it VTI or tunnel mode?

                            What does its connection block in /var/etc/ipsec/swanctl.conf look like?

                            Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                            Need help fast? Netgate Global Support!

                            Do not Chat/PM for help!

                            F 1 Reply Last reply Reply Quote 1
                            • jimpJ
                              jimp Rebel Alliance Developer Netgate
                              last edited by

                              And you didn't say whether or not it has anything in the logs when you click it

                              Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                              Need help fast? Netgate Global Support!

                              Do not Chat/PM for help!

                              F 1 Reply Last reply Reply Quote 1
                              • F
                                francescouk @jimp
                                last edited by

                                @jimp swanctl.zip

                                1 Reply Last reply Reply Quote 0
                                • jimpJ
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by

                                  That file couldn't have come from an RC image, are you sure you upgraded to 2.1.5 RC?

                                  Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  F 1 Reply Last reply Reply Quote 1
                                  • F
                                    francescouk @jimp
                                    last edited by

                                    @jimp When I click the connect button does not say anything on the logs using:

                                    tail -f /var/log/ipsec.log | grep XXX.XXX.XXX.XXX

                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      francescouk @jimp
                                      last edited by

                                      @jimp 6efd5982-7289-4f6a-a4f1-2a012bb9d968-image.png

                                      1 Reply Last reply Reply Quote 0
                                      • jimpJ
                                        jimp Rebel Alliance Developer Netgate
                                        last edited by

                                        The problem is likely that all the child SA entries have overlapping names (e.g. a bunch are con0, con1, etc and don't have proper names. I don't see how that can happen on the RC image unless something else altered the code (like maybe you reverted a previously applied patch after upgrading). It was fixed by https://redmine.pfsense.org/issues/11487 at least any case I've been able to replicate is fixed.

                                        I can't replicate what you are seeing here but if there is a lingering issue it could be from something else in your config. If you can attach a copy of the <ipsec> section of your config.xml (with private stuff redacted) that may help.

                                        But first make sure you didn't revert anything in the system patches package.

                                        Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                        Need help fast? Netgate Global Support!

                                        Do not Chat/PM for help!

                                        F 1 Reply Last reply Reply Quote 1
                                        • F
                                          francescouk @jimp
                                          last edited by

                                          @jimp config.zip

                                          1 Reply Last reply Reply Quote 0
                                          • jimpJ
                                            jimp Rebel Alliance Developer Netgate
                                            last edited by

                                            I put in some dummy addresses and loaded that into a 2.5.1 RC VM and on mine, the config looks right, and the connect button works.

                                            I'm not quite sure what state your system is in but it's very questionable.

                                            swanctl.conf.txt

                                            Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                            Need help fast? Netgate Global Support!

                                            Do not Chat/PM for help!

                                            F 3 Replies Last reply Reply Quote 1
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.