Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Phase 2 Entries for IPSec Multi-Site Hub and Spoke

    Scheduled Pinned Locked Moved IPsec
    2 Posts 2 Posters 217 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bkhiatt
      last edited by

      I'm sorry I'm sure this is a frequent question, but I have been searching and can't seem to find the answer.
      I'm new at all this and IPSec isn't my thing so to speak. There's got to be something basic I'm missing but for the life of me I can't see it.

      I have 3 sites. A, Hub, and B.
      I have IPSec working from A to Hub and B to Hub.
      I can't get IPSec working from A to B through the Hub.
      I've added the additional Phase 2 entries for this based on all the forum posts and documentation I can find, but its not working (routed IPSec isn't an option for me right now either).

      Hub has a fixed WAN address, Spoke A and Spoke B have DHCP/Dynamic WAN addresses.
      Hub:

      • WAN=Fixed
      • LAN=192.168.23.0/24
      • IPSec to Spoke A
      • P1: Fixed to 0.0.0.0 <--Works
      • P2: 192.168.23.0/24 to 192.168.75.0/24 <--Works
      • P2: 192.168.10.0/24 to 192.168.75.0/24 <--Not working
      • IPSec to Spoke B
      • P1: Fixed to 0.0.0.0 <--Works
      • P2: 192.168.23.0/24 to 192.168.10.0/24 <--Works
      • P2: 192.168.75.0/24 to 192.168.10.0/24 <--Not working

      Spoke A:

      • WAN=DHCP
      • LAN=192.168.75.0/24
      • IPSec to Hub
      • P1: 0.0.0.0 to Fixed <--Works
      • P2: 192.168.75.0/24 to 192.168.23.0/24 <--Works
      • P2: 192.168.75.0/24 to 192.168.10.0/24 <--Not working

      Spoke B:

      • WAN=DHCP
      • LAN=192.168.10.2/24
      • IPSec
      • P1: 0.0.0.0 to Fixed <<--Works
      • P2: 192.168.10.0/24 to 192.168.23.0/24 <--Works
      • P2: 192.168.10.0/24 to 192.168.75.0/24 <--Not working

      Since its worth 1000 words, I've also attached a picture.

      The firewall rules for IPSec are set to any/any for all 3 firewalls. But since the P2 links aren't going active I'm not sure I have a firewall problem (but who knows).
      All 3 firewalls are SG-3100's running 24.03

      I found the logs, but I can't make sense of them.
      Can anyone see what I am doing wrong here?Firewall-IPSec.JPG

      All help appreciated and thanks in advance!
      --Brian

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @bkhiatt
        last edited by

        @bkhiatt
        Are all phase 2 shown up as connected in Status > IPSec?

        Please post Status > IPsec > SPDs of all three sites.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.