Multi Ipsec VPN Problem
-
I use multiple IPSec VPN connections, the connection problem after a certain period following the link breaks and the vpn is not held back
2.1-DEVELOPMENT (amd64)
-
You'll need to provide a lot more info:
Did your IPsec VPNs work well before upgrading to 2.1-DEVEL? (if so, which pfsense version 1.2.3 or 2.0.1?)
DPD?
NAT-T?
IPsec mobile?
etcAlso provide full racoon logs.
-
I previously was using version 2.0.1
DPD - Disable
NAT-T - Disable
IPsec mobile - Enable
-
-
Still not enough info here.
You need to post your IPsec logs from when it's failing to reconnect, along with the output of
setkey -D
setkey -DPFrom when it's working and when it's not working, for comparison.
-
$ setkey -DP
192.168.55.0/24[any] 192.168.55.254[any] 255
in none
spid=2 seq=11 pid=54024
refcnt=1
192.168.15.0/24[any] 192.168.55.0/24[any] 255
in ipsec
esp/tunnel/95.x.xx.xx-213.xxx.xxx.xx/unique#16386
spid=4 seq=10 pid=54024
refcnt=1
192.168.5.0/24[any] 192.168.55.0/24[any] 255
in ipsec
esp/tunnel/78.xxx.xxx.xxx-213.xxx.xxx.xx/unique#16388
spid=6 seq=9 pid=54024
refcnt=1
192.168.6.0/24[any] 192.168.55.0/24[any] 255
in ipsec
esp/tunnel/78.xxx.xxx.xxx-213.xxx.xxx.xx/unique#16390
spid=8 seq=8 pid=54024
refcnt=1
192.168.8.0/24[any] 192.168.55.0/24[any] 255
in ipsec
esp/tunnel/78.xxx.xx.xx-213.xxx.xxx.xx/unique#16392
spid=10 seq=7 pid=54024
refcnt=1
192.168.18.0/24[any] 192.168.55.0/24[any] 255
in ipsec
esp/tunnel/81.xxx.xx.xxx-213.xxx.xxx.xx/unique#16394
spid=12 seq=6 pid=54024
refcnt=1
192.168.55.254[any] 192.168.55.0/24[any] 255
out none
spid=1 seq=5 pid=54024
refcnt=1
192.168.55.0/24[any] 192.168.15.0/24[any] 255
out ipsec
esp/tunnel/213.xxx.xxx.xx-95.x.xx.xx/unique#16385
spid=3 seq=4 pid=54024
refcnt=1
192.168.55.0/24[any] 192.168.5.0/24[any] 255
out ipsec
esp/tunnel/213.xxx.xxx.xx-78.xxx.xxx.xxx/unique#16387
spid=5 seq=3 pid=54024
refcnt=1
192.168.55.0/24[any] 192.168.6.0/24[any] 255
out ipsec
esp/tunnel/213.xxx.xxx.xx-78.xxx.xxx.xxx/unique#16389
spid=7 seq=2 pid=54024
refcnt=1
192.168.55.0/24[any] 192.168.8.0/24[any] 255
out ipsec
esp/tunnel/213.xxx.xxx.xx-78.xxx.xx.xx/unique#16391
spid=9 seq=1 pid=54024
refcnt=1
192.168.55.0/24[any] 192.168.18.0/24[any] 255
out ipsec
esp/tunnel/213.xxx.xxx.xx-81.xxx.xx.xxx/unique#16393
spid=11 seq=0 pid=54024
refcnt=1
-
$ setkey -D
213.xxx.xxx.xx 78.xxx.xx.xx
esp mode=any spi=3620357127(0xd7ca4407) reqid=16391(0x00004007)
E: aes-cbc 7686bf77 f62b0396 d41e52d4 65acc363
A: hmac-sha1 951974a6 81da8068 82e549bb 4d753766 0ff8689b
seq=0x00000183 replay=4 flags=0x00000000 state=mature
created: Apr 13 16:04:16 2012 current: Apr 13 17:22:06 2012
diff: 4670(s) hard: 28800(s) soft: 23040(s)
last: Apr 13 17:21:41 2012 hard: 0(s) soft: 0(s)
current: 271224(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 387 hard: 0 soft: 0
sadb_seq=7 pid=18139 refcnt=2
78.xxx.xx.xx 213.xxx.xxx.xx
esp mode=tunnel spi=128898573(0x07aed60d) reqid=16392(0x00004008)
E: aes-cbc 2a1bce17 3cdd25cb b29efca3 b9d46f1d
A: hmac-sha1 a5f03b30 158f7622 759d231a affa0159 d9bbdf42
seq=0x00000148 replay=4 flags=0x00000000 state=mature
created: Apr 13 16:04:16 2012 current: Apr 13 17:22:06 2012
diff: 4670(s) hard: 28800(s) soft: 23040(s)
last: Apr 13 17:21:41 2012 hard: 0(s) soft: 0(s)
current: 32597(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 328 hard: 0 soft: 0
sadb_seq=6 pid=18139 refcnt=1
213.xxx.xxx.xx 95.x.xx.xx
esp mode=any spi=81132314(0x04d5fb1a) reqid=16385(0x00004001)
E: aes-cbc f7a70af4 58addc1a 584a8e6f 33b8bab4
A: hmac-sha1 bed0d0fd 37a90867 49efd159 3b5baa6d 631a8627
seq=0x000012fe replay=4 flags=0x00000000 state=mature
created: Apr 13 16:01:15 2012 current: Apr 13 17:22:06 2012
diff: 4851(s) hard: 28800(s) soft: 23040(s)
last: Apr 13 17:22:05 2012 hard: 0(s) soft: 0(s)
current: 709808(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 4862 hard: 0 soft: 0
sadb_seq=5 pid=18139 refcnt=2
95.x.xx.xx 213.xxx.xxx.xx
esp mode=tunnel spi=223923227(0x0d58cc1b) reqid=16386(0x00004002)
E: aes-cbc 0b13ac84 23799226 acf6c001 b42c191f
A: hmac-sha1 9b24e11f 51f58595 1438b99a 874c678e 8f076aae
seq=0x00000000 replay=4 flags=0x00000000 state=mature
created: Apr 13 16:01:15 2012 current: Apr 13 17:22:06 2012
diff: 4851(s) hard: 28800(s) soft: 23040(s)
last: hard: 0(s) soft: 0(s)
current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 0 hard: 0 soft: 0
sadb_seq=4 pid=18139 refcnt=1
213.xxx.xxx.xx 78.xxx.xxx.xxx
esp mode=any spi=2785857967(0xa60cd1af) reqid=16389(0x00004005)
E: aes-cbc 2d8f8dc8 fd0edb39 5f487fc3 868cb40c
A: hmac-sha1 9e7861f2 6db71edb 97c85e2f eeb2d92a 7840d4e5
seq=0x000042aa replay=4 flags=0x00000000 state=mature
created: Apr 13 16:01:14 2012 current: Apr 13 17:22:06 2012
diff: 4852(s) hard: 28800(s) soft: 23040(s)
last: Apr 13 17:22:05 2012 hard: 0(s) soft: 0(s)
current: 19091504(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 17066 hard: 0 soft: 0
sadb_seq=3 pid=18139 refcnt=2
78.xxx.xxx.xxx 213.xxx.xxx.xx
esp mode=tunnel spi=174727792(0x0a6a2270) reqid=16390(0x00004006)
E: aes-cbc e95d38fd 59f37f5d 20d87b10 2994deac
A: hmac-sha1 51d83dfb 66de3f2e 9a80fc0d 720da3fd 6df1003c
seq=0x000032e6 replay=4 flags=0x00000000 state=mature
created: Apr 13 16:01:14 2012 current: Apr 13 17:22:06 2012
diff: 4852(s) hard: 28800(s) soft: 23040(s)
last: Apr 13 17:22:05 2012 hard: 0(s) soft: 0(s)
current: 3143780(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 13030 hard: 0 soft: 0
sadb_seq=2 pid=18139 refcnt=1
213.xxx.xxx.xx 78.xxx.xxx.xxx
esp mode=any spi=3295792916(0xc471cf14) reqid=16387(0x00004003)
E: aes-cbc 50de0576 3aa95c37 dba14263 57737455
A: hmac-sha1 dded9c1f 6b2135a8 60d934a5 a9d7a5a3 3ac9fcb5
seq=0x00003023 replay=4 flags=0x00000000 state=mature
created: Apr 13 16:01:11 2012 current: Apr 13 17:22:06 2012
diff: 4855(s) hard: 28800(s) soft: 23040(s)
last: Apr 13 17:22:00 2012 hard: 0(s) soft: 0(s)
current: 7009560(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 12323 hard: 0 soft: 0
sadb_seq=1 pid=18139 refcnt=2
78.xxx.xxx.xxx 213.xxx.xxx.xx
esp mode=tunnel spi=91025691(0x056cf11b) reqid=16388(0x00004004)
E: aes-cbc 8f05fb5d 766899c7 ab518e46 e438d3ec
A: hmac-sha1 e7d8fe13 6e9141d0 b219c538 cd66f662 e88604d3
seq=0x000031bb replay=4 flags=0x00000000 state=mature
created: Apr 13 16:01:11 2012 current: Apr 13 17:22:06 2012
diff: 4855(s) hard: 28800(s) soft: 23040(s)
last: Apr 13 17:22:03 2012 hard: 0(s) soft: 0(s)
current: 1495084(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 12731 hard: 0 soft: 0
sadb_seq=0 pid=18139 refcnt=1
