forum.lissyara.su

Код: Выделить всё

Правила firewall'а
IPv4 ESP 	pass 	all 	any to any
IPv4 UDP 	pass 	all 	any to any 500 (ISAKMP)
IPv4 UDP 	pass 	all 	any to any 4500 (IPsec NAT-T)
и
правило IPSec'а "all from any to any"

Код: Выделить всё

VPN: IPsec: Edit Phase 1

Internet Protocol: IPv4
Interface: WAN
Remote gateway: XXX.XXX.XXX.XXX

Phase 1 proposal (Authentication)

Authentication method: Mutual PSK
Negotiation mode: main

My identifier: pfsense.home.net
Peer identifier: pfsense.remote.net

Pre-Shared Key: 123456

Policy Generation: Unique
Proposal Checking: Obey
Encryption algorithm: AES 128bit
Hash algorithm: SHA-1
DH key group: 2 (1024 bit)
Lifetime seconds: 86400

NAT Traversal: Enable
Dead Peer Detection: Enable
seconds: 10
retries: 5


VPN: IPsec: Edit Phase 2

Mode: Tunnel IPv4
Local Network
	Type: Network 
	Address: 192.168.1.0/24

In case you need NAT/BINAT on this network specify the address to be translated
Type: Address
Address: 192.168.5.13 (!!! Здесь указывал IP шлюза, который находится за NAT'ом)

Remote Network
	Type:	Network
	Address: 192.168.18.0/24

Phase 2 proposal (SA/Key Exchange)

Protocol: ESP
Encryption algorithms: AES 128-bit
Hash algorithms: SHA1
PFS key group: off
Lifetime 	seconds: 28800

Automatically ping host IP address: 192.168.18.1

Код: Выделить всё

VPN: IPsec: Edit Phase 1

Internet Protocol: IPv4
Interface: WAN
Remote gateway: YYY.YYY.YYY.YYY (!!! тут указан внешний IP шлюза за которым находится второй pfSense)

Phase 1 proposal (Authentication)

Authentication method: Mutual PSK
Negotiation mode: main

My identifier: pfsense.remote.net
Peer identifier: pfsense.home.net

Pre-Shared Key: 123456

Policy Generation: Unique
Proposal Checking: Obey
Encryption algorithm: AES 128bit
Hash algorithm: SHA-1
DH key group: 2 (1024 bit)
Lifetime seconds: 86400

NAT Traversal: Enable
Dead Peer Detection: Enable
seconds: 10
retries: 5


VPN: IPsec: Edit Phase 2

Mode: Tunnel IPv4
Local Network
	Type: Network 
	Address: 192.168.18.0/24

	In case you need NAT/BINAT on this network specify the address to be translated
	Type: None
	Address:

Remote Network
	Type:	Network
	Address: 192.168.1.0/24

Phase 2 proposal (SA/Key Exchange)

Protocol: ESP
Encryption algorithms: AES 128-bit
Hash algorithms: SHA1
PFS key group: off
Lifetime 	seconds: 28800

Automatically ping host IP address: 192.168.1.1

Код: Выделить всё

Mar 18 19:50:37 	racoon: ERROR: phase1 negotiation failed due to time up. 3bf28ebc9a474745:7ade12ff14755e90
Mar 18 19:50:54 	racoon: [YYY.YYY.YYY.YYY]: INFO: IPsec-SA request for YYY.YYY.YYY.YYY queued due to no phase1 found.
Mar 18 19:50:54 	racoon: [YYY.YYY.YYY.YYY]: INFO: initiate new phase 1 negotiation: XXX.XXX.XXX.XXX[500]<=>YYY.YYY.YYY.YYY[500]
Mar 18 19:50:54 	racoon: INFO: begin Identity Protection mode.
Mar 18 19:51:26 	racoon: [YYY.YYY.YYY.YYY]: [YYY.YYY.YYY.YYY] ERROR: phase2 negotiation failed due to time up waiting for phase1 [Remote Side not responding]. ESP YYY.YYY.YYY.YYY[0]->XXX.XXX.XXX.XXX[0]
Mar 18 19:51:26 	racoon: INFO: delete phase 2 handler.

Код: Выделить всё

Mar 18 21:46:12 	racoon: ERROR: phase1 negotiation failed due to time up. 401a1fc0abda8c7f:0000000000000000
Mar 18 21:49:47 	racoon: [XXX.XXX.XXX.XXX]: INFO: IPsec-SA request for XXX.XXX.XXX.XXX queued due to no phase1 found.
Mar 18 21:49:47 	racoon: [XXX.XXX.XXX.XXX]: INFO: initiate new phase 1 negotiation: 192.168.5.13[500]<=>XXX.XXX.XXX.XXX[500]
Mar 18 21:49:47 	racoon: INFO: begin Identity Protection mode.
Mar 18 21:50:18 	racoon: [XXX.XXX.XXX.XXX]: [XXX.XXX.XXX.XXX] ERROR: phase2 negotiation failed due to time up waiting for phase1 [Remote Side not responding]. ESP XXX.XXX.XXX.XXX[0]->192.168.5.13[0]
Mar 18 21:50:18 	racoon: INFO: delete phase 2 handler.