IPsec behind Carrier Grade Nat & routed vti
-
Site A is has a public ip adress. Site B is behind an ISPs Carrier Grade NAT. I would like to connect the two sites with an IPsec IKEv2 tunnel. Phase 1 & 2 are establishing successfully. Then I assigned the interfaces on both sites & added Any to Any firewall rules for IPsec. Then I rebooted both pfSense. The tunnel established successfully but no packets are going through the vti. Both firewalls telling me the other gateway is offline. If I do the same with another pfSense installation without NAT-T everything works fine. Any suggestions?
-
Not directly related to ipsec but I had the same issues with ssh and CGNAT, switched over to reverse ssh which solved that, maybe you can do the same with ipsec.
-
I found the issue. I set the identifier of the public site to "My IP Address" and the remote identifier to any. Then I changed the remote address to an dyndns address of the CGNat Ip (public one, not the internal ip). On Site B I set the remote identifier to "Peer IP Address" and my identifier to DynDns with the dyndns hostname. Then everything worked fine....