Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Ipsec

    Scheduled Pinned Locked Moved IPsec
    12 Posts 3 Posters 5.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rana
      last edited by

      hello i have been trying to setup ipsec
      i used this to setup my vpn
      http://doc.pfsense.org/index.php/IPsec_Road_Warrior/Mobile_Client_How-To

      it looks like i can connect to me pfsense but i cant ping any of my computers please help

      config loaded for site 'XXXXXXXXXX'
      configuring client settings …
      attached to key daemon ...
      peer configured
      iskamp proposal configured
      esp proposal configured
      client configured
      local id configured
      pre-shared key configured
      bringing up tunnel ...
      network device configured
      tunnel enabled

      see dont have any problems there

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        Did you add firewall rules under Firewall > Rules, on the IPsec tab?

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • R
          rana
          last edited by

          do you mean this

          rules.jpg
          rules.jpg_thumb

          1 Reply Last reply Reply Quote 0
          • R
            rana
            last edited by

            also i hope this helps you to help me thank you

            Feb 8 15:48:26 racoon: [Unknown Gateway/Dynamic]: INFO: ISAKMP-SA established 67.49.xxx.xxx[500]-12.173.xxx.xxx[472] spi:ea5a84ca885ca505:c542fcd1decf936c
            Feb 8 15:48:26 racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 2 negotiation: 67.49.xxx.xxx[0]<=>12.173.xxx.xxx[0]
            Feb 8 15:48:26 racoon: [Unknown Gateway/Dynamic]: INFO: no policy found, try to generate the policy : 192.168.4.32/32[0] 192.168.1.0/24[0] proto=any dir=in
            Feb 8 15:48:27 racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP 12.173.xxx.xxx[0]->67.49.xxx.xxx[0] spi=161391074(0x99ea1e2)
            Feb 8 15:48:27 racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP 67.49.xxx.xxx[0]->12.173.xxx.xxx[0] spi=1085753737(0x40b74989)
            Feb 8 15:48:27 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "192.168.4.32/32[0] 192.168.1.0/24[0] proto=any dir=in"
            Feb 8 15:48:27 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "192.168.1.0/24[0] 192.168.4.32/32[0] proto=any dir=out"
            Feb 8 15:54:16 racoon: INFO: generated policy, deleting it.
            Feb 8 15:54:16 racoon: [Unknown Gateway/Dynamic]: INFO: ISAKMP-SA expired 67.49.xxx.xxx[500]-12.173.xxx.xxx[472] spi:ea5a84ca885ca505:c542fcd1decf936c
            Feb 8 15:54:17 racoon: [Unknown Gateway/Dynamic]: INFO: ISAKMP-SA deleted 67.49.xxx.xxx[500]-12.173.xxx.xxx[472] spi:ea5a84ca885ca505:c542fcd1decf936c
            Feb 8 16:13:26 racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 1 negotiation: 67.49.xxx.xxx[500]<=>12.173.xxx.xxx[489]

            1 Reply Last reply Reply Quote 0
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by

              @rana:

              do you mean this

              The protocol on that rule is set for only TCP. Change that to "Any"

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • R
                rana
                last edited by

                i tryed that but no lock here are more pic
                i have been reading the book and i still dont get it please help its making me go crazy i think im missing some rules or something

                1.jpg
                1.jpg_thumb
                2.jpg
                2.jpg_thumb
                3.jpg
                3.jpg_thumb

                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  That all looks right.

                  Are you seeing any entries in the firewall log for the times you have tried to ping?

                  Is pfSense the default gateway for the PCs you are trying to ping?

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • R
                    rana
                    last edited by

                    nothing in the firewall logs and yes its on the default gateway

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      Do you have the Dashboard package installed on pfSense? There is an IPsec status widget there which can report the status of mobile tunnels. I wonder if it shows as up/green in that view when the client is connected.

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      1 Reply Last reply Reply Quote 0
                      • R
                        rana
                        last edited by

                        Active Tunnels  Inactive Tunnels
                                0                          0

                        and nothing under
                        Tunnel Status

                        1 Reply Last reply Reply Quote 0
                        • R
                          rkelleyrtp
                          last edited by

                          Can you please tell us exactly what you are trying to accomplish?  Are you configuring a site-to-site ipsec tunnel, or are you configuring mobile ipsec clients?  Your screenshots seem to indicate you are doing a site-to-site tunnel.  If so, what device is at the other end of the tunnel (Cisco, pfSense, etc)?

                          1 Reply Last reply Reply Quote 0
                          • R
                            rkelleyrtp
                            last edited by

                            Sorry, my mistake.  Your screen grabs looked just like the site-to-site tunnel config screen.

                            What kind of logs does your client get during tunnel negotiation?  What kind of client are you using?

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.