After upgrade to 2.5.0 IpSec connect button is not working
-
Hi there,
After upgrade my pfsense to 2.5.0 the ipsec connect button does not work anymore. Anyone having the same problem?
-
It's a known issue:
https://redmine.pfsense.org/issues/11486Fixed in the upcoming release.
-
@jimp That´s the thing. Even applying the pactch, I still cannot connect manually. The only thing that happens is that the page reload after clicking on the connect button and that´s it.
-
You may also be affected by one of the other related bugs, it might not be the connect button at all but the way the connection block is written in the config.
Best thing to do at this point is to upgrade from 2.5.0 to the 2.5.1 RC snapshot and try it there.
-
@jimp Do you have a procedure for upgrading?
-
-
@jimp I can confirm that after the upgrade, the problem still persist. I cannot make the tunnel to connect manually.
-
Do you see anything in the IPsec logs when you click the button?
If you right click the button and copy the URL, what are the parameters? (e.g.
status_ipsec.php?act=connect&ikeid=1)And what kind of tunnel is it? Does it have a defined remote gateway address or is using something like an FQDN or maybe
0.0.0.0/0/%any? -
@jimp said in After upgrade to 2.5.0 IpSec connect button is not working:
https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html
Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
Thanks for the efforts that Netgate is doing to solve the problems. -
@mcury said in After upgrade to 2.5.0 IpSec connect button is not working:
@jimp said in After upgrade to 2.5.0 IpSec connect button is not working:
https://www.netgate.com/blog/open-call-for-testing-pfsense-plus-and-ce-release-candidates.html
Hello Jimp, I would like to help, is it safe to test 21.02p2 in a SG-3100?
Thanks for the efforts that Netgate is doing to solve the problems.It should be, yes. I'm running 21.02.2 on two SG-3100 units here and thus far haven't had any major issues.
-
-
Is it VTI or tunnel mode?
What does its connection block in
/var/etc/ipsec/swanctl.conflook like? -
And you didn't say whether or not it has anything in the logs when you click it
-
-
That file couldn't have come from an RC image, are you sure you upgraded to 2.1.5 RC?
-
@jimp When I click the connect button does not say anything on the logs using:
tail -f /var/log/ipsec.log | grep XXX.XXX.XXX.XXX
-
-
The problem is likely that all the child SA entries have overlapping names (e.g. a bunch are
con0,con1, etc and don't have proper names. I don't see how that can happen on the RC image unless something else altered the code (like maybe you reverted a previously applied patch after upgrading). It was fixed by https://redmine.pfsense.org/issues/11487 at least any case I've been able to replicate is fixed.I can't replicate what you are seeing here but if there is a lingering issue it could be from something else in your config. If you can attach a copy of the
<ipsec>section of your config.xml (with private stuff redacted) that may help.But first make sure you didn't revert anything in the system patches package.
-
-
I put in some dummy addresses and loaded that into a 2.5.1 RC VM and on mine, the config looks right, and the connect button works.
I'm not quite sure what state your system is in but it's very questionable.
-
@jimp Can you at least point me how to solve this problem? Should reinstall? Or anything that could result in sucess??
Before upgrade to RC version, I had applied all the patches:
ead6515637a34ce6e170e2d2b0802e4fa1e63a00 #11435
57beb9ad8ca11703778fc483c7cba0f6770657ac #11435
10eb04259fd139c62e08df8de877b71fdd0eedc8 #11442
ded7970ba57a99767e08243103e55d8a58edfc35 #11486
afffe759c4fd19fe6b8311196f4b6d5e288ea4fb #11487
2fe5cc52bd881ed26723a81e0eed848fd505fba6 #11488But the ipsec status widget wasn´t working, the connect button also wasn´t working.. so I dunno
-
@jimp For some reason now when I click on connect button it start showing connection:
-
@jimp The other thing I just find out. The screen for the ipsec connections that´s working is different than the new ones. Follow:
Ipsec Config Working:
Ipsec Config NOT Working:
As you can see, the screen is different on Expiration Item
-
The difference between those screenshots is the IKE version (IKEv1 vs Auto), the missing field is only valid for IKEv2 (and Auto can use IKEv2). It's not likely to be related to any problem you are seeing.
