Bug #14626: Multi-WAN IPsec does not fail over when preferred WAN loses link - pfSense - pfSense bugtracker

Actions

Copy link

Bug #14626

closed

Multi-WAN IPsec does not fail over when preferred WAN loses link

Added by Thomas Simon over 1 year ago. Updated about 1 year ago.

Status:

Resolved

Priority:

Normal

Assignee:

Jim Pingle

Category:

IPsec

Target version:

2.7.1

Start date:

Due date:

% Done:

100%

Estimated time:

Plus Target Version:

23.09

Release Notes:

Default

Affected Version:

2.7.0

Affected Architecture:

Description

I have a site to site to vpn over ipsec between HO and a branch office. Now i have got added one more WAN connection to the branch side pfsense. Dyndns with gateway group is configured and everything works as expected. Dyndns updates the failover gateway IP immediately with the help of a cron job which runs at every one minute.

On the HO pfsense in ipsec phase-1, remote gateway is configured as the branche's dyndns hostname.

However a failover never happens and IPsec will not automatically connects to the newly updated dyndns hostname IP. If the branch side pfsense is rebooted, connection will be established.

What configuration is missed which will enable ipsec to drop the tunnel established to the failed IP and to reestablish a new tunnel with the changed/updated dyndns hostname IP automatically.

Thanks
Thomas

Files

Download all files

HO.JPG (68.2 KB) HO.JPG		Thomas Simon, 07/29/2023 03:18 PM
Branch.JPG (66.6 KB) Branch.JPG		Thomas Simon, 07/29/2023 03:19 PM
Branch IPSec.JPG (36.6 KB) Branch IPSec.JPG	Stays in connecting mode, the WAN IP never changes to the failover WAN IP.	Thomas Simon, 07/29/2023 03:22 PM
IPSEC Log.txt (32.8 KB) IPSEC Log.txt	IPSec Log file	Thomas Simon, 07/30/2023 07:52 PM

Related issues

Actions

Copy link

Updated by Thomas Simon over 1 year ago

File Branch IPSec.JPG Branch IPSec.JPG added

Thomas Simon wrote:

Hi

I have a site to site to vpn over ipsec between HO and a branch office. Now i have got added one more WAN connection to the branch side pfsense. Dyndns with gateway group is configured and everything works as expected. Dyndns updates the failover gateway IP immediately with the help of a cron job which runs at every one minute.

On the HO pfsense in ipsec phase-1, remote gateway is configured as the branche's dyndns hostname.

However a failover never happens and IPsec will not automatically connects to the newly updated dyndns hostname IP. If the branch side pfsense is rebooted, connection will be established.

What configuration is missed which will enable ipsec to drop the tunnel established to the failed IP and to reestablish a new tunnel with the changed/updated dyndns hostname IP automatically.

Thanks
Thomas

The issue here seems to be, 'Local Host WAN IP' is not changing from the failed WAN IP to the failover WAN IP automatically.
the link https://redmine.pfsense.org/issues/13076 talks about the same issue and says an edit to rc.ipsec file fixes the issue.

But didn't get how to make that edit.

Actions

Copy link

Updated by Kris Phillips over 1 year ago

Thomas Simon wrote in #note-1:

Thomas Simon wrote:

Hi

I have a site to site to vpn over ipsec between HO and a branch office. Now i have got added one more WAN connection to the branch side pfsense. Dyndns with gateway group is configured and everything works as expected. Dyndns updates the failover gateway IP immediately with the help of a cron job which runs at every one minute.

On the HO pfsense in ipsec phase-1, remote gateway is configured as the branche's dyndns hostname.

However a failover never happens and IPsec will not automatically connects to the newly updated dyndns hostname IP. If the branch side pfsense is rebooted, connection will be established.

What configuration is missed which will enable ipsec to drop the tunnel established to the failed IP and to reestablish a new tunnel with the changed/updated dyndns hostname IP automatically.

Thanks
Thomas

The issue here seems to be, 'Local Host WAN IP' is not changing from the failed WAN IP to the failover WAN IP automatically.
the link https://redmine.pfsense.org/issues/13076 talks about the same issue and says an edit to rc.ipsec file fixes the issue.

But didn't get how to make that edit.

Hello Thomas,

Are you seeing attempts to re-establish the IPSec tunnel in the logs? It looks like, based on your screenshots, that your firewall is double NAT'ed.

The redmine you linked should be resolved in 2.7, which you stated in the bug report you are running, so that shouldn't affect you.

Actions

Copy link

Updated by Thomas Simon over 1 year ago

File IPSEC Log.txt IPSEC Log.txt added

Kris Phillips wrote in #note-2:

Thomas Simon wrote in #note-1:

Thomas Simon wrote:

Hi

I have a site to site to vpn over ipsec between HO and a branch office. Now i have got added one more WAN connection to the branch side pfsense. Dyndns with gateway group is configured and everything works as expected. Dyndns updates the failover gateway IP immediately with the help of a cron job which runs at every one minute.

On the HO pfsense in ipsec phase-1, remote gateway is configured as the branche's dyndns hostname.

However a failover never happens and IPsec will not automatically connects to the newly updated dyndns hostname IP. If the branch side pfsense is rebooted, connection will be established.

What configuration is missed which will enable ipsec to drop the tunnel established to the failed IP and to reestablish a new tunnel with the changed/updated dyndns hostname IP automatically.

Thanks
Thomas

The issue here seems to be, 'Local Host WAN IP' is not changing from the failed WAN IP to the failover WAN IP automatically.
the link https://redmine.pfsense.org/issues/13076 talks about the same issue and says an edit to rc.ipsec file fixes the issue.

But didn't get how to make that edit.

Hello Thomas,

Are you seeing attempts to re-establish the IPSec tunnel in the logs? It looks like, based on your screenshots, that your firewall is double NAT'ed.

The redmine you linked should be resolved in 2.7, which you stated in the bug report you are running, so that shouldn't affect you.

Hi Kris. thanks for the quick response. Yes, attempting. However on the failed WAN IP itself. Log file attached. What I am doing here is disabling the primary WAN interface(192.168.2.100) to test the failover. Is it the right way to do it ?

Actions

Copy link

Updated by Jim Pingle over 1 year ago

Thomas Simon wrote in #note-3:

Hi Kris. thanks for the quick response. Yes, attempting. However on the failed WAN IP itself. Log file attached. What I am doing here is disabling the primary WAN interface(192.168.2.100) to test the failover. Is it the right way to do it ?

That wouldn't replicate a real-world failure. What you should do is somehow prevent it from communicating out that WAN. For example, by unplugging the cable from the Fiber/Cable/Telco going to the CPE on that WAN. Unplugging the WAN is still different than the majority of WAN failures but also worth trying.

Disabling the interface is a much, much different code path that will not be remotely close to anything that would normally happen, and isn't a good test.

Actions

Copy link

Updated by Georgiy Tyutyunnik about 1 year ago

Related to Bug #14829: Multi-WAN Dynamic DNS does not fail over when preferred WAN loses link added

Actions

Copy link

Updated by Jim Pingle about 1 year ago

File 1087.diff added
Subject changed from IPSec with dual WAN to Multi-WAN IPsec does not fail over when preferred WAN loses link
Status changed from New to Pull Request Review
Assignee set to Jim Pingle
Target version set to 2.8.0
Plus Target Version set to 23.09