Skip to main content
wimvs
wimvs
New Member
October 1, 2018
Question

IPSec VPN Issue between Fortigate and PFsense

  • October 1, 2018
  • 1 reply
  • 20951 views

Hello,

 

We have an issue with a vpn connection between our fortigate 1500 5.4.9 and a pfsense .

Every other day the connection seems to fail, although in the monitor it says up.

 

I tried to run a debug an saw following errors:

 

ike 0: IKEv1 exchange=Informational id=d2b4fbda4a1b86b6/3d93fbe1f03ab63c:c50ec69d len=92
ike 0: in D2B4FBDA4A1B86B63D93FBE1F03AB63C08100501C50EC69D0000005C6B5E7C4EFD095DFA5BCA2A434841E4B0D28396448A736307E765E605C7F27163B35D65933B41CD3926E7608FE97F8E57818771AC40872D5D873CB16C0CB9EBE8
ike 0: comes xxxxxxxxxxxx->xxxxxxxxxxxxxxx:500,ifindex=25....
ike 0: IKEv2 exchange=CREATE_CHILD id=45e679806abf7eff/2d1b3353efb6e979:00000002 len=416
ike 0: in <cut>
ike 0:<vpnname>:11257: dec <cut>
ike 0:<vpnname>:11257: received create-child request
ike 0:<vpnname>:11257: responder received CREATE_CHILD exchange
ike 0:<vpnname>:11257: received notify type ESP_TFC_PADDING_NOT_SUPPORTED
ike 0:<vpnname>:11257: processing child notify type ESP_TFC_PADDING_NOT_SUPPORTED
ike 0:<vpnname>:11257: responder creating new child
ike 0:<vpnname>:11257:1488982: peer proposal:

 

We are stuck here. Sometimes our connection is stable for a long time, then we have times it goes down every 24 hours with 'no' reason.

Any advice is appreciated.

 

Regards.

Wim

 

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 1, 2018

    Are you using IKEv1 or IKEv2? The capture includes both.

    wimvs
    wimvsAuthor
    New Member
    October 3, 2018

    We are using IKEv2 on this one.

     

    Regards

    Wim

     

     
    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 3, 2018

    The particular part of debug log you showed it not an error. A normal exchange based on RFC 5996 [[link]https://tools.ietf.org/html/rfc5996[/link]]

    "The ESP_TFC_PADDING_NOT_SUPPORTED notification asserts that the sending endpoint will not accept packets that contain Traffic Flow Confidentiality (TFC) padding over the Child SA being negotiated. If neither endpoint accepts TFC padding, this notification is included in both the request and the response."

     

    What do you see in VPN event log?

    Terms & ConditionsAccessibility statement