Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Site-to-Site IPsec - Both PFsense 2.0 Release tunnel drops after some time idle

    IPsec
    1
    4
    9.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dfarr89
      last edited by

      I have 2 pfsense boxes both 2.0 release with dynamic ip (i use no-ip). They both connect via IPsec correctly and data is sent over the tunnel both ways perfectly. The majority of the time that the tunnel is left idle though traffic just wont start going through it again (sometimes it does). i tried everything and would much appreciate some help!

      One of the routers is dual wan (Ipsec tunnel is on the secondary WAN not default)

      is there any way i could increase the lifetime of the tunnel? I would like it to be always on and instant like PPTP for instance?

      Much appreciated!

      1 Reply Last reply Reply Quote 0
      • D
        dfarr89
        last edited by

        Some more info: The router with multi wan after the first tunnel drop shows 3 SAs while the other one still has 2 SAs. I have checked prefer older SAs but this still keeps happening.

        1 Reply Last reply Reply Quote 0
        • D
          dfarr89
          last edited by

          here's an excerpt of racoon's log during a period of idle time

          Oct 1 00:25:05 racoon: [Unknown Gateway/Dynamic]: ERROR: pfkey DELETE received: ESP X.X.X.X[500]->X.X.X.X[500] spi=149865750(0x8eec516)
          Oct 1 00:25:02 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=191046787(0xb632483)
          Oct 1 00:25:02 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=217404996(0xcf55644)
          Oct 1 00:25:02 racoon: [SITE2]: INFO: respond new phase 2 negotiation: X.X.X.X[500]<=>X.X.X.X[500]
          Oct 1 00:24:54 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=149865750(0x8eec516)
          Oct 1 00:24:54 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=147191536(0x8c5f6f0)
          Oct 1 00:24:54 racoon: [SITE2]: INFO: initiate new phase 2 negotiation: X.X.X.X[500]<=>X.X.X.X[500]
          Oct 1 00:10:47 racoon: [SITE2]: INFO: IPsec-SA expired: ESP/Tunnel X.X.X.X[500]->X.X.X.X[500] spi=151215834(0x9035eda)
          Oct 1 00:10:47 racoon: [SITE2]: INFO: IPsec-SA expired: ESP X.X.X.X[500]->X.X.X.X[500] spi=264718127(0xfc7472f)
          Sep 30 23:22:49 racoon: ERROR: pfkey DELETE received: ESP X.X.X.X[500]->X.X.X.X[500] spi=249948619(0xee5e9cb)
          Sep 30 23:22:46 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=264718127(0xfc7472f)
          Sep 30 23:22:46 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=151215834(0x9035eda)
          Sep 30 23:22:46 racoon: [SITE2]: INFO: respond new phase 2 negotiation: X.X.X.X[500]<=>X.X.X.X[500]
          Sep 30 23:22:40 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=249948619(0xee5e9cb)
          Sep 30 23:22:40 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=175102881(0xa6fdba1)
          Sep 30 23:22:40 racoon: [SITE2]: INFO: initiate new phase 2 negotiation: X.X.X.X[500]<=>X.X.X.X[500]
          Sep 30 23:08:32 racoon: [SITE2]: INFO: IPsec-SA expired: ESP/Tunnel X.X.X.X[500]->X.X.X.X[500] spi=138644480(0x8438c00)
          Sep 30 23:08:32 racoon: [SITE2]: INFO: IPsec-SA expired: ESP X.X.X.X[500]->X.X.X.X[500] spi=222367625(0xd410f89)
          Sep 30 22:20:34 racoon: ERROR: pfkey DELETE received: ESP X.X.X.X[500]->X.X.X.X[500] spi=240815526(0xe5a8da6)
          Sep 30 22:20:31 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=222367625(0xd410f89)
          Sep 30 22:20:31 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=138644480(0x8438c00)
          Sep 30 22:20:31 racoon: [SITE2]: INFO: respond new phase 2 negotiation: X.X.X.X[500]<=>X.X.X.X[500]
          Sep 30 22:20:26 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=240815526(0xe5a8da6)
          Sep 30 22:20:26 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=54177470(0x33aaebe)
          Sep 30 22:20:26 racoon: [SITE2]: INFO: initiate new phase 2 negotiation: X.X.X.X[500]<=>X.X.X.X[500]
          Sep 30 22:06:53 racoon: ERROR: X.X.X.X give up to get IPsec-SA due to time up to wait.
          Sep 30 22:06:23 racoon: [SITE2]: INFO: IPsec-SA expired: ESP/Tunnel X.X.X.X[500]->X.X.X.X[500] spi=2916835(0x2c81e3)
          Sep 30 22:06:23 racoon: [SITE2]: INFO: initiate new phase 2 negotiation: X.X.X.X[500]<=>X.X.X.X[500]
          Sep 30 22:06:23 racoon: [SITE2]: INFO: IPsec-SA expired: ESP X.X.X.X[500]->X.X.X.X[500] spi=230696136(0xdc024c8)
          Sep 30 22:06:16 racoon: [SITE2]: INFO: IPsec-SA expired: ESP/Tunnel X.X.X.X[500]->X.X.X.X[500] spi=46582079(0x2c6c93f)
          Sep 30 21:23:26 racoon: ERROR: pfkey DELETE received: ESP X.X.X.X[500]->X.X.X.X[500] spi=178744507(0xaa76cbb)
          Sep 30 21:18:22 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=230696136(0xdc024c8)
          Sep 30 21:18:22 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=2916835(0x2c81e3)
          Sep 30 21:18:15 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=178744507(0xaa76cbb)
          Sep 30 21:18:15 racoon: [SITE2]: INFO: IPsec-SA established: ESP X.X.X.X[500]->X.X.X.X[500] spi=46582079(0x2c6c93f)
          Sep 30 21:18:15 racoon: [SITE2]: INFO: respond new phase 2 negotiation: X.X.X.X[500]<=>X.X.X.X[500]
          Sep 30 21:18:12 racoon: [SITE2]: INFO: initiate new phase 2 negotiation: X.X.X.X[500]<=>X.X.X.X[500]
          Sep 30 21:05:07 racoon: [SITE2]: INFO: IPsec-SA expired: ESP/Tunnel X.X.X.X[500]->X.X.X.X[500] spi=175593561(0xa775859)
          Sep 30 21:05:07 racoon: [SITE2]: INFO: IPsec-SA expired: ESP X.X.X.X[500]->X.X.X.X[500] spi=1543384(0x178cd8)

          1 Reply Last reply Reply Quote 0
          • D
            dfarr89
            last edited by

            I hope everyone follows my example and posts solutions to frustrating problems they encounter like I am doing (even if they do not receive any help). To resolve this issue disable NAT-T (when pfsense holds the public IP). If that still does not help disable DPD and set 'Negotiation Mode' in Phase 1 to main (pfsense is at both ends in my scenario).

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.