• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Ipsec Configuration not Working!

Scheduled Pinned Locked Moved IPsec
66 Posts 6 Posters 14.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • I
    ibnkamala @gabacho4
    last edited by Jun 13, 2022, 4:05 PM

    @gabacho4 will do that.

    L 1 Reply Last reply Jun 13, 2022, 4:50 PM Reply Quote 0
    • L
      luckman212 LAYER 8 @ibnkamala
      last edited by luckman212 Jun 13, 2022, 5:03 PM Jun 13, 2022, 4:50 PM

      Now that both boxes are on 2.6, may I suggest switching to WireGuard since it is more NAT friendly, and requires just a single UDP port to be forwarded. You can try this without disturbing the IPsec config you have done so far (just disable the P1 to test)

      https://docs.netgate.com/pfsense/en/latest/recipes/wireguard-s2s.html

      I 1 Reply Last reply Jun 13, 2022, 5:36 PM Reply Quote 0
      • I
        ibnkamala @luckman212
        last edited by Jun 13, 2022, 5:36 PM

        @luckman212 what do you mean exactly I have to disable phase1 in both sites, then how can we test ? I will forward simple to the Pfsense.

        L 1 Reply Last reply Jun 13, 2022, 6:41 PM Reply Quote 0
        • L
          luckman212 LAYER 8 @ibnkamala
          last edited by Jun 13, 2022, 6:41 PM

          @ibnkamala I am saying: forwarding the ports and protocols needed to make IPSEC work in a double-NAT scenario (such as you have) is not an easy task. It seems you might be a little over your head with it.

          So, I suggested changing strategy and trying Wireguard, which is a completely different protocol, to establish the site-to-site tunnel. I posted a link to the guide so you could try to set it up.

          If you do give that a try, just stick to the default port (udp/51820) and forward that port from "Simple Internet Box" to your inside SiteA pfSense, and also forward from SiteB Sonicwall to pfSense. It's just another possible solution.

          1 Reply Last reply Reply Quote 0
          • G
            gary.lopez @gabacho4
            last edited by Oct 3, 2022, 4:18 PM

            @gabacho4 tenia este problema y exactamente esta era la solucion, mis 2 firewalls estan detras del NAT, me funciono perfectamente para la conexion IPSEC. Solo me sucedio de Pfsense a Pfsense.
            aclaro, uso la version 2.6, tal vez el compañero deba actualizar la su version.

            G 1 Reply Last reply Oct 3, 2022, 4:29 PM Reply Quote 0
            • G
              gabacho4 Rebel Alliance @gary.lopez
              last edited by Oct 3, 2022, 4:29 PM

              @gary-lopez quieres decir que usando el KeyID era la clave para tu éxito? Lo siento pero después de cuatro meses y muchos mensajes entre mi y el amigo, no estoy seguro cual te ayudo. De todas maneras te felicito.

              G 1 Reply Last reply Oct 3, 2022, 4:42 PM Reply Quote 1
              • G
                gary.lopez @gabacho4
                last edited by Oct 3, 2022, 4:42 PM

                @gabacho4 Asi es, ya estoy un poco familiarizado, no soy experto pero ese problema lo tenia desde hace meses pero no le dedique mucho tiempo ya que en produccion tengo de Pfsense a un Fortigate y me dejo levantar la VPN sin la necesidad de poner la KEY ID, use como identificador My IP Address que es la que te da por Default. Otra ventaja que tengo es que mi ISP o modem lo tengo en DMZ y el servico de Dynamic DNS en el pfsense.

                G 1 Reply Last reply Oct 3, 2022, 4:53 PM Reply Quote 0
                • G
                  gabacho4 Rebel Alliance @gary.lopez
                  last edited by gabacho4 Oct 3, 2022, 4:56 PM Oct 3, 2022, 4:53 PM

                  @gary-lopez es posible que haya otra solución pero no he experimentado hasta ahora. Una de mis instancias de pfsense esta detras de NAT y la otra no. Ya que pude hacer la conexión de esta manera no quise gastar mas tiempo y energía. Si te dan las ganas un día de estos, deberías investigar VTI IPSec ya que ese tipo te da una interfaz y gateway que puedes usar para PBR etc.

                  G 1 Reply Last reply Oct 3, 2022, 5:31 PM Reply Quote 0
                  • G
                    gary.lopez @gabacho4
                    last edited by Oct 3, 2022, 5:31 PM

                    @gabacho4 Tomare en cuenta tus comentarios, muchas gracias por comentar mi estimado, espero apoyar algun dia, y a seguir investigando. Saludos desde Mexico

                    G 1 Reply Last reply Oct 3, 2022, 5:45 PM Reply Quote 0
                    • G
                      gabacho4 Rebel Alliance @gary.lopez
                      last edited by Oct 3, 2022, 5:45 PM

                      @gary-lopez viva la raza carnal!

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                        This community forum collects and processes your personal information.
                        consent.not_received