<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[PfSense 1.2.3PRE &lt;–--&gt; pfSense 1.2.2 | IPSec Tunnel Simply Won&#x27;t Work]]></title><description><![CDATA[<p dir="auto">I am at my wits end here.  I can't seem to get my IPSec tunnel up and running between our office and our new colo facility.  I currently have a working tunnel between the same 1.2.3PRE and a 1.2 instance.  I am not sure what else to try.  I have ensured that all the settings are equal and properly configured.  I have tried rebooting both pfSense machines.  I have no idea what the next step is here.</p>
<p dir="auto">I have attached the relevant bits of the log file as well as my racoon.conf.  If anyone sees anything obvious here, please help me out.</p>
<p dir="auto">Thanks!<br />
Geoff</p>
<p dir="auto">This message is displayed on our central office pfSense server:</p>
<pre><code>
Aug 25 21:38:53 	racoon: ERROR: failed to get sainfo.
Aug 25 21:38:25 	last message repeated 3 times
Aug 25 21:37:55 	racoon: ERROR: couldn't find configuration.
Aug 25 21:37:48 	racoon: INFO: unsupported PF_KEY message REGISTER

</code></pre>
<p dir="auto">This message is displayed on our satellite collocation pfSense server:</p>
<pre><code>
Aug 25 20:38:16 	racoon: INFO: delete phase 2 handler.
Aug 25 20:38:16 	racoon: [Office VPN2]: ERROR: phase2 negotiation failed due to time up waiting for phase1\. ESP 75.150.XX.XX[0]-&gt;208.93.XX.XX[0]
Aug 25 20:37:45 	racoon: INFO: begin Aggressive mode.
Aug 25 20:37:45 	racoon: [Office VPN2]: INFO: initiate new phase 1 negotiation: 208.93.XX.XX[500]&lt;=&gt;75.150.XX.XX[500]
Aug 25 20:37:45 	racoon: [Office VPN2]: INFO: IPsec-SA request for 75.150.XX.XX queued due to no phase1 found.

</code></pre>
<p dir="auto">This is the configuration of the central office pfSense server 1.2.3PRE (please note, one of the connections is working fine connected to a 1.2 pfSense):</p>
<pre><code>
# This file is automatically generated. Do not edit
listen {
	adminsock "/var/run/racoon.sock" "root" "wheel" 0660;
}
path pre_shared_key "/var/etc/psk.txt";

path certificate  "/var/etc";

remote 66.66.66.66 {
	exchange_mode aggressive;
	my_identifier fqdn "office.connectfirst.com";

	peers_identifier address 66.66.66.66;
	initial_contact on;
	#dpd_delay 120;                   # DPD poll every 120 seconds
	ike_frag on;
	support_proxy on;
	proposal_check obey;

	proposal {
		encryption_algorithm 3des;
		hash_algorithm sha1;
		authentication_method pre_shared_key;
		dh_group 2;
	}
}

sainfo address 192.168.200.0/24 any address 10.2.0.0/16 any {
	encryption_algorithm 3des,blowfish,cast128,rijndael,rijndael 256;
	authentication_algorithm hmac_sha1,hmac_md5;
	compression_algorithm deflate;
	pfs_group 2;
}

remote 77.77.77.77 {
	exchange_mode aggressive;
	my_identifier fqdn "office.connectfirst.com";

	peers_identifier address 77.77.77.77;
	initial_contact on;
	#dpd_delay 120;                   # DPD poll every 120 seconds
	ike_frag on;
	support_proxy on;
	proposal_check obey;

	proposal {
		encryption_algorithm 3des;
		hash_algorithm sha1;
		authentication_method pre_shared_key;
		dh_group 2;
	}
}

sainfo address 192.168.200.0/24 any address 10.3.0.0/16 any {
	encryption_algorithm 3des,blowfish,cast128,rijndael,rijndael 256;
	authentication_algorithm hmac_sha1,hmac_md5;
	compression_algorithm deflate;
	pfs_group 2;
}

</code></pre>
<p dir="auto">This is the configuration of the broken satellite collocation pfSense server 1.2.2:</p>
<pre><code>
path pre_shared_key "/var/etc/psk.txt";

path certificate  "/var/etc";

remote 55.55.55.55 {
	exchange_mode aggressive;
	my_identifier fqdn "55m.domain.com";

	peers_identifier address 55.55.55.55;
	initial_contact on;
	#dpd_delay 120;                   # DPD poll every 120 seconds
	ike_frag on;
	support_proxy on;
	proposal_check obey;

	proposal {
		encryption_algorithm 3des;
		hash_algorithm sha1;
		authentication_method pre_shared_key;
		dh_group 2;
	}
}

sainfo address 10.3.0.0/16 any address 192.168.200.0/24 any {
	encryption_algorithm 3des,blowfish,cast128,rijndael,rijndael 256;
	authentication_algorithm hmac_sha1,hmac_md5;
	compression_algorithm deflate;
	pfs_group 2;
}

</code></pre>
<p dir="auto">This is the configuration of the WORKING satellite collocation pfSense server:\</p>
<pre><code>
path pre_shared_key "/var/etc/psk.txt";

path certificate  "/var/etc";

remote 55.55.55.55 {
	exchange_mode aggressive;
	my_identifier fqdn "atl.domain.com";

	peers_identifier address 55.55.55.55;
	initial_contact on;
	support_proxy on;
	proposal_check obey;

	proposal {
		encryption_algorithm 3des;
		hash_algorithm sha1;
		authentication_method pre_shared_key;
		dh_group 2;
	}
}

sainfo address 10.2.0.0/16 any address 192.168.200.0/24 any {
	encryption_algorithm 3des,blowfish,cast128,rijndael,rijndael 256;
	authentication_algorithm hmac_sha1,hmac_md5;
	compression_algorithm deflate;
	pfs_group 2;
}

</code></pre>
<p dir="auto">If there is any other information I can provide, please let me know.</p>
<p dir="auto">Thanks!</p>
]]></description><link>https://forum.netgate.com/topic/17533/pfsense-1-2-3pre-pfsense-1-2-2-ipsec-tunnel-simply-won-t-work</link><generator>RSS for Node</generator><lastBuildDate>Wed, 12 Aug 2026 20:39:45 GMT</lastBuildDate><atom:link href="https://forum.netgate.com/topic/17533.rss" rel="self" type="application/rss+xml"/><pubDate>Wed, 26 Aug 2009 01:45:56 GMT</pubDate><ttl>60</ttl></channel></rss>