Actions
Bug #3995
closed
Site-to-site VPN not working on IKEv2
Start date:
11/07/2014
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2
Affected Architecture:
Description
Sometime in the recent past, AES-GCM has stopped working. To replicate, just setup a site to site IPsec VPN using AES-GCM and try to bring it up. You'll end up with something like this over and over:
Nov 7 01:03:39 pfSense charon: 09[ENC] parsed CREATE_CHILD_SA response 7 [ N(INVAL_SYN) ] Nov 7 01:03:39 pfSense charon: 09[IKE] <con1|23> received INVALID_SYNTAX notify error Nov 7 01:03:39 pfSense charon: 09[IKE] received INVALID_SYNTAX notify error
Updated by Chris Buechler about 10 years ago
I don't know the cause, but it seems most likely to be when we bumped to strongswan 5.2.1 last week. There was a patch dropped in the process, though that may have been intentional, not sure.
Updated by Ermal Luçi about 10 years ago
- Subject changed from AES-GCM not working to Site-to-site VPN not working on IKEv2
- Status changed from New to Feedback
Rightsourceip was being set on site-to-site/peer-to-peer configs which is wrong.
Updated by Ermal Luçi about 10 years ago
- % Done changed from 0 to 100
Applied in changeset 80be089f050f0f27398a2f35ff5d48f43c7cfa3f.
Actions