IPSEC 2.2.1 to 2.2.3 tunnel initiates but traffic does not pass

  • Good morning,

    I updated a firewall last evening that has about 15 IPSEC tunnels some with multiple phase 2 entries.

    I have one tunnel in particular where there are two phase 2 entries.

    One phase 2 entry comes up without issue and passes traffic bi-directionally with no issues.

    The second phase 2 tunnels shows as being up and the traffic count increments from the remote end, but 0 traffic passes from the local end to the remote end.

    I can bring the tunnel up from the remote end by initiating traffic but not from the local end.

    I tried rebuilding the tunnel and still can't bring up the second phase 2 entry.

    I created a firewall rule to log all traffic from the local side to the remote side but do not see any entries in the log.  If I ping from the remote end to the local end, I see state entries get created but still no traffic will pass.

    Any thoughts on this?

    Thank you,


  • You're most likely hitting https://redmine.pfsense.org/issues/4791.

    Workaround is to disable AES-NI: system_advanced_misc.php, set 'Cryptographic Hardware' to 'None', then reboot.

  • Thanks, that solved my problems. As a newbie on pfSense, I thought the guides painted a fairly pain-free picture of setting up IPsec, and my tunnels connected just fine, but absolutely no traffic passed through… Was pulling my hair out before I found this answer, and everything works brilliantly now, so - THANK YOU!


Log in to reply