26.7 IPSEC Draytek

[MoonbeamFrame]

Post upgrade I'm seeing an issue with traffic between a firewall running 26.7 and four Draytek 286x routers.

The tunnels are showing as active at both ends, traffic is reported leaving the OPNsense firewall, but I'm not seeing it arrive at the Draytek end.

Anyone else seeing similar?

[nero355]

Anyone else seeing similar?

I guess so : https://forum.opnsense.org/index.php?topic=52410.0

Seems like a general bug related to IPSEC in 26.7 sadly...

[Denniz]

Post upgrade I'm seeing an issue with traffic between a firewall running 26.7 and four Draytek 286x routers.

The tunnels are showing as active at both ends, traffic is reported leaving the OPNsense firewall, but I'm not seeing it arrive at the Draytek end.

Anyone else seeing similar?

Kind of, as nero355 linked, I also have some problems with ipsec after the update. Do you use VTI or tunnel mode and does any traffic at all pass thru the tunnels now? I can get traffic passing but not multicast ospf that worked before.

[MoonbeamFrame]

All use tunnel mode.

These tunnels are configured to be uni-directional (for monitoring purposes), but I do see a few bytes (<500) coming into the OPNsense FW as reported on the VPN: IPsec: Status Overview page. Nothing reported going out.

The Firewall: Log Files: Live View does show outbound traffic being passed.

I was eventually able to see a message in the Draytek syslog explorer that may be useful:

## IKEv2 DBG : Process Packet : Receive IKEv2_INFORMATIONAL but can't find state for iCookie = c46dbe5dad535841 rCookie = 9b374fd129951dbc from {IP_Address}

But I've not found much detail on it yet.