Hi
We installed a new pfsense with 2.8.1 at a remote site and tried to establish an IPsec tunnel (P1) from another site which ran on 2.7.2
We were not able to establish the connection, always got error message like the ones below.
We have had a IPsec connection working between 2 sites running on 2.7.2
After a while of trying out and checking we decided to upgrade one of the machines to 2.8.1
Result: Now the formerly working IPsec connection can’t be established showing the same errors.
So my best guess is that there is a change of behaviour with 2.8.2.
The systems are communicating yet finally not connecting. Any hint is very much appreciated, thanks in advance.
This is the last part of the log:
Jul 17 17:33:59 charon 47965 10[CFG] <82> looking for peer configs matching 192.168.1.122[%any]…83.xx.xxx.xx[192.168.200.103]
Jul 17 17:33:59 charon 47965 10[CFG] <82> no matching peer config found
Jul 17 17:33:59 charon 47965 10[IKE] <82> received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Jul 17 17:33:59 charon 47965 10[ENC] <82> generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Jul 17 17:33:59 charon 47965 10[NET] <82> sending packet: from 192.168.1.122[4500] to 83.xx.xxx.xx[4500] (80 bytes)
Jul 17 17:33:59 charon 47965 10[IKE] <82> IKE_SA (unnamed)[82] state change: CONNECTING => DESTROYING
That log looks like a Phase 1 identifier mismatch rather than a proposal/PSK problem. The remote connection is arriving from 83.xx.xxx.xx, but it is presenting 192.168.200.103 as its IKE identity.