IPSEC 2.2.1 to 2.2.3 tunnel initiates but traffic does not pass

[abeauchamp]

Good morning,

I updated a firewall last evening that has about 15 IPSEC tunnels some with multiple phase 2 entries.

I have one tunnel in particular where there are two phase 2 entries.

One phase 2 entry comes up without issue and passes traffic bi-directionally with no issues.

The second phase 2 tunnels shows as being up and the traffic count increments from the remote end, but 0 traffic passes from the local end to the remote end.

I can bring the tunnel up from the remote end by initiating traffic but not from the local end.

I tried rebuilding the tunnel and still can't bring up the second phase 2 entry.

I created a firewall rule to log all traffic from the local side to the remote side but do not see any entries in the log.  If I ping from the remote end to the local end, I see state entries get created but still no traffic will pass.

Any thoughts on this?

Thank you,

Alex

[praseodym]

You're most likely hitting https://redmine.pfsense.org/issues/4791.

Workaround is to disable AES-NI: system_advanced_misc.php, set 'Cryptographic Hardware' to 'None', then reboot.

[winobob]

Thanks, that solved my problems. As a newbie on pfSense, I thought the guides painted a fairly pain-free picture of setting up IPsec, and my tunnels connected just fine, but absolutely no traffic passed through… Was pulling my hair out before I found this answer, and everything works brilliantly now, so - THANK YOU!

Cheers,
Örjan