Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSEC Road Warrior randomly works…

    Scheduled Pinned Locked Moved IPsec
    2 Posts 1 Posters 3.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      michaelahess
      last edited by

      Here's the log from two connection attempts, one from a directly connected to internet laptop win7 with shrew client, the other from a win7 shrew client pc behind a pfsense box running 1.2.3-rc1. I had to disable NAT-T to get either to connect, shouldn't that be required for the pfsense client? The funny thing is both log's are the same!

      Works:

      Sep 6 12:39:28 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "192.168.0.0/24[0] 69.145.x.x/32[0] proto=any dir=out"
      Sep 6 12:39:28 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "69.145.x.x/32[0] 192.168.0.0/24[0] proto=any dir=in"
      Sep 6 12:39:28 racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP 216.67.x.x[500]->69.145.x.x[500] spi=3129556591(0xba893e6f)
      Sep 6 12:39:28 racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP 69.145.x.x[0]->216.67.x.x[0] spi=254951700(0xf324114)
      Sep 6 12:39:28 racoon: [Unknown Gateway/Dynamic]: INFO: no policy found, try to generate the policy : 69.145.x.x/32[0] 192.168.0.0/24[0] proto=any dir=in
      Sep 6 12:39:28 racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 2 negotiation: 216.67.x.x[500]<=>69.145.x.x[500]
      Sep 6 12:39:28 racoon: INFO: generated policy, deleting it.
      Sep 6 12:39:28 racoon: [Unknown Gateway/Dynamic]: INFO: ISAKMP-SA established 216.67.x[500]-69.145.x.x[500] spi:198705ee906fabba:730c28bf8cd9ae4e
      Sep 6 12:39:27 racoon: INFO: received Vendor ID: CISCO-UNITY
      Sep 6 12:39:27 racoon: INFO: received Vendor ID: RFC 3947
      Sep 6 12:39:27 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
      Sep 6 12:39:27 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
      Sep 6 12:39:27 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-01
      Sep 6 12:39:27 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
      Sep 6 12:39:27 racoon: INFO: begin Aggressive mode.
      Sep 6 12:39:27 racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 1 negotiation: 216.67.x.x[500]<=>69.145.x.x[500]

      Doesn't work:

      Sep 6 12:40:51 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "192.168.0.0/24[0] 10.54.25.3/32[0] proto=any dir=out"
      Sep 6 12:40:51 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "10.54.25.3/32[0] 192.168.0.0/24[0] proto=any dir=in"
      Sep 6 12:40:51 racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP 216.67.x.x[500]->69.145.x.x[49036] spi=3626258225(0xd8244f31)
      Sep 6 12:40:51 racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP 69.145.x.x[0]->216.67.x.x[0] spi=100369758(0x5fb855e)
      Sep 6 12:40:51 racoon: [Unknown Gateway/Dynamic]: INFO: no policy found, try to generate the policy : 10.54.25.3/32[0] 192.168.0.0/24[0] proto=any dir=in
      Sep 6 12:40:51 racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 2 negotiation: 216.67.x.x[500]<=>69.145.x.x[49036]
      Sep 6 12:40:51 racoon: INFO: generated policy, deleting it.
      Sep 6 12:40:51 racoon: [Unknown Gateway/Dynamic]: INFO: ISAKMP-SA established 216.67.x.x[500]-69.145.x.x[49036] spi:332d086c6d1b1fab:6b2a4e44c140fb5a
      Sep 6 12:40:50 racoon: INFO: received Vendor ID: CISCO-UNITY
      Sep 6 12:40:50 racoon: INFO: received Vendor ID: RFC 3947
      Sep 6 12:40:50 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
      Sep 6 12:40:50 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
      Sep 6 12:40:50 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-01
      Sep 6 12:40:50 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
      Sep 6 12:40:50 racoon: INFO: begin Aggressive mode.
      Sep 6 12:40:50 racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 1 negotiation: 216.67.x.x[500]<=>69.145.x.x[49036]

      1 Reply Last reply Reply Quote 0
      • M
        michaelahess
        last edited by

        I got it working, most clients can connect some can't due to their firewalls. I've verified IPSEC passthrough is enabled but that doesn't matter. I've tried to enable NAT-T but then nothing works. It breaks IPSEC completely on the pfsense box.

        Also, the ones that do work require me to set static dns, if I enter the dns servers on the DNS tab of the shrew client it doesn't work at all. Any thoughts? When will there be a solid road warrior implementation of IPSEC? Will there be or is OpenVPN expected to replace it?

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.