0

Has anyone here been able to specify a stable configuration for the L2L VPN between an ASA device and pfSense 2.0.1? I am using the most accomodating settings on the ASA side (DefaultL2LGroup with many transform sets and using PSK so that the pfSense device does all of the specifying of networks) and the simplest settings on the pfSense end (default settings + no DPD + NAT-T enabled. The P1/P2 lifetimes match on both ends. P2 uses 3DES/SHA1 specified in pfSense and simply tunnels LAN net to the other LAN. There are no IP addressing conflicts between the networks, no complex routing going on, etc. It's pretty much a /24 LAN to another /24 LAN, and it works almost all of the time. However, the tunnel drops intermittently (perhaps 2-5 times per day) and although it is very hard to predict, it occurs all of the time! I've been pulling hair out trying to get it to stop dropping but so far I have had no luck. I've even heard from some colleagues that there is something about Cisco's IPSec implementation that precludes pfSense and ASA from playing nicely. Is there anything left to try? Can anyone provide some anecdotal tips or tricks to diagnose and/or fix the dropped tunnel?

Things I have tried

  • Viewing racoon debug log
  • Eliminating DPD
  • Different lifetime values (both ends)
  • Having the ASA initiate traffic (not DefaultL2LGroup)

Any and all help is tremendously appreciated.

Improve this question
1
  • How are you verifying that the connection's down? And does it come back up immediately when traffic is sent through? Can you provide logs from either or both ends?
    – Shane Madden
    Jun 2, 2012 at 18:40

1 Answer 1

Reset to default
1

I had a problem that exhibited behavior almost identical to yours. I was trying to run off-site backups with Veeam over the VPN. The job would run fine for somewhere between 2-6 hours usually, but at some point it would fail. Veeam support reviewed the logs and indicated it was related to a poor quality network connection. I looked at the Cisco ASA firewall and it showed errors:

show int eth 0/0 | inc error

The ASA outside interface was configured to auto negotiate speed and duplex, and was running at 100 Mbit half-duplex. I manually set the interface to 100 Mbit full-duplex, and have not had a problem with the off-site backup job since.

Here are the settings I'm using on pfSense 2.0.1. Note that a number of these were not default settings, and I had to verify that the Cisco ASA settings matched (especially lifetimes).

Phase 1:

Authentication method: Mutual PSK
Negotiation mode: aggressive
My identifier: KeyID tag, DefaultL2LGroup
Peer identifier: Peer IP address
Policy Generation: Unique
Proposal Checking: Obey
Encryption algorithm: 3DES
Hash algorithm: MD5
DH key group: 2
Lifetime: 86400
NAT Traversal: Enable
Dead Peer Detection: disabled

Phase 2:

Mode: Tunnel
Protocol: ESP
Encryption: 3DES
Hash: MD5
PFS key group: off
Lifetime: 28800
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .