Bug #12488
closedProblem with IPSEC - DPD or Child SA keep-alive
0%
Description
I was trying to Configure a new Site to Site IPsec tunnel.
We already have 3 Sites, with lots of Child SA's, in our pfsense and this will be number 4.
The other (older) Connections / Sites work well (2x XG-7100 1U, 1xSG-1100)
After Configure everything as usual the following happend:
Traffic from Site A (debian10,strongswan 5.7.2) to Site B (pfsense+ on XG-7100 1U v2.5.1) don't work until.
Site B sends traffic to Site A.
DPD is enabled on Both Sites.
I also have Configured the keep-alive setting: https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/keep-alive.html to Child SA / P2.
But it don't work very well, after some debuging i found this:
https://forum.netgate.com/topic/85691/ipsec-ping-host-for-keepalive-doesn-t-work/2
Witch brought me to ping_hosts.sh:
When i use ping_hosts.sh from CLI it runs like 9 to 10 minutes!
Investigating ping_hosts.sh brought me to /var/db/ipsecpinghosts with 31 entries in my case (4 Sites).
24 IP's in this entries don't exists (DOKU: It does not have to reply or even exist)
If i understand ping_hosts.sh correct a entry like this '192.168.0.1|192.168.68.254|3|||||6|' in /var/db/ipsecpinghosts
Means: ping from 192.168.0.1 to 192.168.68.254 3 times with 6sec timeout?
This will result in 6s timeout x 3 times x 24 entries = 432 sec | 7,2 minutes for all my non-existent keep-alive ip's
Dos thins mean the pfsense only send Traffic every 12 minutes (minicron 240 ping_hosts.sh[10+ min for ping_hosts.sh in my case] ) to Site A?
If i reconfigure and use only existing keep-alive IP's in Child SA's.
The ping_hosts.sh run in about one an a half minute and my tunnels are (more) stable.
But even this is not enough. After some Testing ist looks like i need to Configure, to send Traffic every 30 seconds for a stable Tunnel.
Is there a way to Configure The keep-alive Traffic on a per Connection and Child SA base like:
default 240s
CON1 - P2 net1: every 30s
CON1 - P2 net2: every 30s
CON2 - P2 net1: default
CON2 - P2 net2: default
Updated by Jim Pingle over 3 years ago
- Status changed from New to Not a Bug
This site is not for support or diagnostic discussion.
For assistance in solving problems, please post on the Netgate Forum or the pfSense Subreddit .
See Reporting Issues with pfSense Software for more information.
Additionally, numerous IPsec issues have already been addressed in development snapshots (Plus 22.01, CE 2.6.0). Before reporting IPsec problems, try reproducing the scenario on current development snapshots.