Project

General

Profile

Actions

Bug #12488

closed

Problem with IPSEC - DPD or Child SA keep-alive

Added by Marc Schildt over 3 years ago. Updated over 3 years ago.

Status:
Not a Bug
Priority:
Normal
Assignee:
-
Category:
IPsec
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
2.5.1
Affected Architecture:
7100

Description

I was trying to Configure a new Site to Site IPsec tunnel.
We already have 3 Sites, with lots of Child SA's, in our pfsense and this will be number 4.
The other (older) Connections / Sites work well (2x XG-7100 1U, 1xSG-1100)

After Configure everything as usual the following happend:
Traffic from Site A (debian10,strongswan 5.7.2) to Site B (pfsense+ on XG-7100 1U v2.5.1) don't work until.
Site B sends traffic to Site A.
DPD is enabled on Both Sites.
I also have Configured the keep-alive setting: https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/keep-alive.html to Child SA / P2.

But it don't work very well, after some debuging i found this:
https://forum.netgate.com/topic/85691/ipsec-ping-host-for-keepalive-doesn-t-work/2

Witch brought me to ping_hosts.sh:
When i use ping_hosts.sh from CLI it runs like 9 to 10 minutes!

Investigating ping_hosts.sh brought me to /var/db/ipsecpinghosts with 31 entries in my case (4 Sites).
24 IP's in this entries don't exists (DOKU: It does not have to reply or even exist)

If i understand ping_hosts.sh correct a entry like this '192.168.0.1|192.168.68.254|3|||||6|' in /var/db/ipsecpinghosts
Means: ping from 192.168.0.1 to 192.168.68.254 3 times with 6sec timeout?
This will result in 6s timeout x 3 times x 24 entries = 432 sec | 7,2 minutes for all my non-existent keep-alive ip's

Dos thins mean the pfsense only send Traffic every 12 minutes (minicron 240 ping_hosts.sh[10+ min for ping_hosts.sh in my case] ) to Site A?

If i reconfigure and use only existing keep-alive IP's in Child SA's.
The ping_hosts.sh run in about one an a half minute and my tunnels are (more) stable.

But even this is not enough. After some Testing ist looks like i need to Configure, to send Traffic every 30 seconds for a stable Tunnel.

Is there a way to Configure The keep-alive Traffic on a per Connection and Child SA base like:
default 240s
CON1 - P2 net1: every 30s
CON1 - P2 net2: every 30s
CON2 - P2 net1: default
CON2 - P2 net2: default

Actions

Also available in: Atom PDF