Home
Help
Search
Login
Register
OPNsense Forum
»
Archive
»
20.7 Legacy Series
»
IPSEC traffic stalling after 20.7.1 upgrade
« previous
next »
Print
Pages:
1
...
3
4
[
5
]
Author
Topic: IPSEC traffic stalling after 20.7.1 upgrade (Read 31534 times)
proctor
Newbie
Posts: 35
Karma: 2
Re: IPSEC traffic stalling after 20.7.1 upgrade
«
Reply #60 on:
March 15, 2021, 11:39:46 am »
Thanks for the hint, I will give it a try (just changed and rebooted).
Logged
glasi
Jr. Member
Posts: 98
Karma: 9
Re: IPSEC traffic stalling after 20.7.1 upgrade
«
Reply #61 on:
May 01, 2021, 12:33:43 pm »
Sill no problems on my end with AES-NI and SHA256.
Have you ever tried AES-GCM instead of AES?
Logged
franco
Administrator
Hero Member
Posts: 17473
Karma: 1587
Re: IPSEC traffic stalling after 20.7.1 upgrade
«
Reply #62 on:
May 02, 2021, 10:09:11 pm »
Might be
https://cgit.freebsd.org/src/commit/?id=62e32cf9140e6c13663dcd69ec3b3c7ca4579782
just a couple of days old.
Cheers,
Franco
Logged
Gilad
Newbie
Posts: 18
Karma: 2
Re: IPSEC traffic stalling after 20.7.1 upgrade
«
Reply #63 on:
May 06, 2021, 12:25:29 am »
Hi, I have a similar problem with OPNsense 21.1.5 running on DEC850 (AMD EPYC 3201). IPsec VPN "Road Warrior" to an iOS device, with the following settings: AES-256, SHA256, DH-14 and ESP.
I can connect successfully, and the VPN tunnel works for 10-20 seconds, but then just dies. I've tried different combinations of encryption and hash, with the same results.
Is the only option currently to disable the AES-NI accelaration?
«
Last Edit: May 06, 2021, 08:06:33 am by Gilad
»
Logged
jfranken
Newbie
Posts: 3
Karma: 0
Re: IPSEC traffic stalling after 20.7.1 upgrade
«
Reply #64 on:
May 11, 2021, 12:02:24 pm »
On our OPNsense 21.1.4/DEC3850 we were experiencing several hanging ipsec ikev2 associations per day until I disabled aesni.
Four weeks ago, I changed the phase 1 and 2 algorithms from CBC (
aes256-sha256-modp2048!
) to GCM (
aes256gcm16-sha256-modp2048!
) and re-enabled aesni. Since then, not a single hitch, same with 21.1.5.
Check
grep -e " ike =" -e " esp =" /usr/local/etc/ipsec.conf
to test if you got them all.
Regards
Johannes Franken
«
Last Edit: May 27, 2021, 12:26:45 pm by jfranken
»
Logged
fraenki
Full Member
Posts: 175
Karma: 29
Re: IPSEC traffic stalling after 20.7.1 upgrade
«
Reply #65 on:
May 27, 2021, 12:22:50 pm »
This issue will be fixed in today's release of OPNsense 21.1.6 (about to be released in the upcoming hours).
If it does not solve your issue, then you're most likely experiencing a different issue.
In that case I'd suggest to report a new issue on GitHub.
Regards
- Frank
Logged
Print
Pages:
1
...
3
4
[
5
]
« previous
next »
OPNsense Forum
»
Archive
»
20.7 Legacy Series
»
IPSEC traffic stalling after 20.7.1 upgrade