Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPsec dpinger pings dropped on WAN

    Scheduled Pinned Locked Moved General pfSense Questions
    2 Posts 1 Posters 103 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      michmoor LAYER 8 Rebel Alliance
      last edited by

      Running into a very strange issue here.

      Ive set up an IPsec tunnel - in VTI mode - between 2x pfsense appliances.
      P1/P2 comes up but the gateway is showing as Offline, PacketLoss 100%

      I went over to my firewall logs to review as i know for testing we have wide open rules on IPsec interface to permit pings and i see this flooding my logs

      723a8eed-5167-492d-a661-a1df8384faa1-image.png

      Those are the VTI addresses on each side with 10.6.106.6 being the remote pfsense

      Something funky is happening. Obviously the 10/address isnt routable over the internet but somehow my WAN is seeing it and blocking it by default ruLE.
      Additionally i am not able to ping any of the remote networks and i have a static route in place and i see outbound states being created.

      Firewall: NetGate,Palo Alto-VM,Juniper SRX
      Routing: Juniper, Arista, Cisco
      Switching: Juniper, Arista, Cisco
      Wireless: Unifi, Aruba IAP
      JNCIP,CCNP Enterprise

      M 1 Reply Last reply Reply Quote 0
      • M
        michmoor LAYER 8 Rebel Alliance @michmoor
        last edited by

        @michmoor

        Solved!!
        There was another P2 active.
        So i think i know what happened. Whent he IPsec tunnel was first set up, it was in tunnel mode. Switched over to VTI but the other p2 was still there. Somehow there was a conflict. After deleting the old p2, things are looking good.

        Leaving this here for future me or anyone else

        Firewall: NetGate,Palo Alto-VM,Juniper SRX
        Routing: Juniper, Arista, Cisco
        Switching: Juniper, Arista, Cisco
        Wireless: Unifi, Aruba IAP
        JNCIP,CCNP Enterprise

        1 Reply Last reply Reply Quote 1
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.