Phase 1 up or unstable?



  • I'm trying to establish a site to site IPSec tunnel between two pfSense boxes.  The tunnel's not up, but being new to this, I'm not sure if it's a phase 1 or phase 2 issue.  My log looks like this…

    Jul 14 15:42:44 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=222517895(0xd435a87)
    Jul 14 15:42:44 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=235052421(0xe029d85)
    Jul 14 15:42:51 racoon: [SiteB]: INFO: initiate new phase 2 negotiation: aaa.aaa.aaa.aaa[500]<=>bbb.bbb.bbb.bbb[500]
    Jul 14 15:42:51 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=87610327(0x538d3d7)
    Jul 14 15:42:51 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=202571367(0xc12fe67)
    Jul 14 15:43:13 racoon: [SiteB]: INFO: initiate new phase 2 negotiation: aaa.aaa.aaa.aaa[500]<=>bbb.bbb.bbb.bbb[500]
    Jul 14 15:43:13 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=226876164(0xd85db04)
    Jul 14 15:43:13 racoon: [SiteB]: INFO: IPsec-SA established: ESP aaa.aaa.aaa.aaa[500]->bbb.bbb.bbb.bbb[500] spi=186685903(0xb2099cf)

    and it keeps repeating.  It looks like phase 1 is completing but phase 2 keeps initiating.  I'm not sure if that's because phase 1 is not staying up or because phase 2 can't establish.  I'm not sure where to look from here.  Can anyone point me in the right direction?

    Thanks.



  • On a whim, I changed Policy Generation and Proposal Checking to Default and Encryption to Blowfish on both sides.  Tunnel's now showing up, but traffic's not routing.  I have an IPSec F/W rule allowing any/any on both F/Ws.  If I'm not mistaken, the Local Network and Remote Network fields on the IPSec Phase 2 configuration create a routing table so that if I try to access addresses on Site B from Site A (and my pfSense is my default gateway), it knows to route the traffic through the tunnel, right?  Should I expect to be able to reach my pfSense on Site B from Site A using the IP address of the LAN Interface?  I can when I VPN client to site, but not site to site.

    Thoughts?