Tunnel stopped working and I can't figure out why
-
I have IPSEC tunnels between multiple pfsense firwalls, and all worked fine until a few days ago one tunnel stopped working. It is really couriour, I cannot access Site A from site B and vice versa but it is no problem to reach A from C and B from C and I also can reach C from both sites A and B.
The tunnels are als set up in the same matter, here are a few details, maybe someone sees something I overlook:
Here is the status of site A, there are no packets out
Here is the status of site B, ** there are no packets in and out**
Here is the IPSEC log for site A, there seems to be traffic in both directions isn't?
Here is the IPSEC log for site B, there is also traffic:
So my first question: when there are packets sent in both directions, why the counters are 0 ?
Traced packet trace at site A
Packet trace at site B - only UDP no ESP .... why?
If someone can give any hint this would greatly appreciated, if someone needs more information, please write. Thank you so much!
-
@24fun how are you routing tables and tracerts?
I'm experiencing a lot lot lot of crazy problem with ipsec + routing after upgrade to 2.7
-
In the meantime i figured out, that setting the "NAT Traversal" in Site B from "Auto" to "Forced" in phase 1 settings, solved my problem. Curious, all other tunnels are running with this "auto" setting. ????
-
I've had no issues with IPSec on pf Plus at least, don't have a 2.7 system to test right now though, but that NAT setting normally shouldn't have to be adjusted.
Just out of curiosity, are you seeing any MAC auth errors?
I had an issue a while back, still not sure if it's solved or not (made a post with no responses) and haven't been able to test, but for some reason I was getting a ton of auth issues after updating pfSense to a newer version when it comes to IPSec, turned out that for some reason the option of using "My IP Address" wasn't properly authenticating and I had to manually specify the IP.
Anyway, seems like that's not related to your issue but just wanted to double check since it was something I ran across and never managed to solve.
Edit: here is that post I made: https://forum.netgate.com/topic/176502/had-to-manually-specify-identifier-ip-address-no-nat-involved-bug
Another edit: this does appear to have been resolved, just got it working when before it wouldn't.
