2.1.3 - dropped RA and PA packets
-
I've got a bridged 2.1.3 box I just put in-line, everything is working fine except connecting to our campus VPN from our desktop pc's. I see in the block logs the attempted connections are being blocked with TCP:RA and TCP:PA protocols. After some digging around I tried this:
https://knowledge.zomers.eu/pfsense/Pages/How-to-solve-connectivity-issues-with-dropped-RA-and-PA-packets.aspx
But no luck. The message when I hover over the block action is: @3 block drop in log inet all label "Default deny rule IPv4"
Wth is causing this block? It's like it ignores my LAN -> Any rule set.
-
RA and PA are not connection attempts, connection attempts would be Syn.. The firewall will drop packets that are out of state, it is common to see these sorts of blocks.
https://doc.pfsense.org/index.php/Why_do_my_logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection
TCP Flags: F - FIN, S - SYN, A or . - ACK, R - RST, P - PSH, U - URG, E - ECE, W - CWR
-
Thanks for the fast reply!
Hmm - when I disable the firewall and just use routing I'm able to connect to the campus cisco VPN. Any idea if I can tweak this single fw rule handle for this particular IP only? Any other place I should see the block attempts to troubleshoot this further? I'd like to keep evaluating pfsense but there's no way this pf box is going to let me reach that external vpn. We are using the Cisco Anywhere VPN Client
-
And your trying to connect to this vpn that is on the internet (wan of pfsense?), another network on your own lan or other lan segment of pfsense? What type of vpn connection are you trying to use - anyconnect can use multiple vpn types I believe are you using just ssl over 443? are you trying to do udp?
-
Yep it's on the WAN side of pfsense. it's the anyconnect ssl vpn looks like using DTLS if I take a look in the transport info when connected
-
Well DTLS is udp I believe, what ports are you using? And what do your lan rules look like? Are they the default any any?
-
just reading here: http://www.cisco.com/c/en/us/support/docs/security/anyconnect-vpn-client/107391-anyconnect-faqs.html
It looks like SSL 443 and DTLS.
I have my LAN rule set as "IPv4 * * * * * * none LAN TO ANY"
This is a bridged configuration - following steps here: http://people.pharmacy.purdue.edu/~tarrh/Transparent%20Firewall-Filtering%20Bridge%20-%20pfSense%202.0.2%20By%20William%20Tarrh.pdf
In my Interfaces I see Floating/LAN/WAN/Bridge - is the bridge killing it?
-
If you bridged it - what does your bridge say tab say, what does the floating say.
Why do you have a bridge?
