IPSEC 2.2.1 to 2.2.3 tunnel initiates but traffic does not pass
-
Good morning,
I updated a firewall last evening that has about 15 IPSEC tunnels some with multiple phase 2 entries.
I have one tunnel in particular where there are two phase 2 entries.
One phase 2 entry comes up without issue and passes traffic bi-directionally with no issues.
The second phase 2 tunnels shows as being up and the traffic count increments from the remote end, but 0 traffic passes from the local end to the remote end.
I can bring the tunnel up from the remote end by initiating traffic but not from the local end.
I tried rebuilding the tunnel and still can't bring up the second phase 2 entry.
I created a firewall rule to log all traffic from the local side to the remote side but do not see any entries in the log. If I ping from the remote end to the local end, I see state entries get created but still no traffic will pass.
Any thoughts on this?
Thank you,
Alex
-
You're most likely hitting https://redmine.pfsense.org/issues/4791.
Workaround is to disable AES-NI: system_advanced_misc.php, set 'Cryptographic Hardware' to 'None', then reboot.
-
Thanks, that solved my problems. As a newbie on pfSense, I thought the guides painted a fairly pain-free picture of setting up IPsec, and my tunnels connected just fine, but absolutely no traffic passed through… Was pulling my hair out before I found this answer, and everything works brilliantly now, so - THANK YOU!
Cheers,
Örjan