IPSec VPN Issue between Fortigate and PFsense

[wimvs]

Hello,

We have an issue with a vpn connection between our fortigate 1500 5.4.9 and a pfsense .

Every other day the connection seems to fail, although in the monitor it says up.

I tried to run a debug an saw following errors:

ike 0: IKEv1 exchange=Informational id=d2b4fbda4a1b86b6/3d93fbe1f03ab63c:c50ec69d len=92
ike 0: in D2B4FBDA4A1B86B63D93FBE1F03AB63C08100501C50EC69D0000005C6B5E7C4EFD095DFA5BCA2A434841E4B0D28396448A736307E765E605C7F27163B35D65933B41CD3926E7608FE97F8E57818771AC40872D5D873CB16C0CB9EBE8
ike 0: comes xxxxxxxxxxxx->xxxxxxxxxxxxxxx:500,ifindex=25....
ike 0: IKEv2 exchange=CREATE_CHILD id=45e679806abf7eff/2d1b3353efb6e979:00000002 len=416
ike 0: in <cut>
ike 0:<vpnname>:11257: dec <cut>
ike 0:<vpnname>:11257: received create-child request
ike 0:<vpnname>:11257: responder received CREATE_CHILD exchange
ike 0:<vpnname>:11257: received notify type ESP_TFC_PADDING_NOT_SUPPORTED
ike 0:<vpnname>:11257: processing child notify type ESP_TFC_PADDING_NOT_SUPPORTED
ike 0:<vpnname>:11257: responder creating new child
ike 0:<vpnname>:11257:1488982: peer proposal:

We are stuck here. Sometimes our connection is stable for a long time, then we have times it goes down every 24 hours with 'no' reason.

Any advice is appreciated.

Regards.

Wim

 

[Toshi_Esumi]

Are you using IKEv1 or IKEv2? The capture includes both.

[wimvs]

We are using IKEv2 on this one.

Regards

Wim

 

[Toshi_Esumi]

The particular part of debug log you showed it not an error. A normal exchange based on RFC 5996 [[link]https://tools.ietf.org/html/rfc5996[/link]]

"The ESP_TFC_PADDING_NOT_SUPPORTED notification asserts that the sending endpoint will not accept packets that contain Traffic Flow Confidentiality (TFC) padding over the Child SA being negotiated. If neither endpoint accepts TFC padding, this notification is included in both the request and the response."

What do you see in VPN event log?

[wimvs]

Hello

We got one IPSec Phase 2 error in our event log, but it doesn't say anything meaningfull to us.

And another one :

 

Thanks in advance.

Regards

Wim

 

[Sudarsan_Babu]

Hi,

Can you share debug flow and share . 

Regards,

Sudarsan Babu P

[wimvs]

Hello

Beneath is the only log I could get, because the times it goes down is sometimes very random. Sometimes it's just around the same hour the next day and that's when I started the debug.

There is also quite some jibberisch from an another tunnel to azure in there.

Regards

Wim