Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What I want to do, for the time being, is get pfSense setup so that a few of my employees can connect from their residences. I have poured over this doc for quite awhile: http://doc.pfsense.org/index.php/IPsec_Road_Warrior/Mobile_Client_How-To with no luck. A quick overview of my network topology: T1 --> Cisco Router 2800 --> Internal Network The box that has pfSense setup resides on the internal network with dual NICs. In the router I have added 3 entires (esp, UDP port 500 and 4500) for IPSec into the ACL for the public IP of the pfSense box.

Now if I try to connect from the local network to the pfSense box via Shrew the log for racoon looks like this:

 racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 1 negotiation: 1.2.3.4[500]<=>192.168.1.44[500]
 Aug 3 17:51:08 racoon: INFO: begin Aggressive mode.
 Aug 3 17:51:08 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
 Aug 3 17:51:08 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-01
 Aug 3 17:51:08 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
 Aug 3 17:51:08 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
 Aug 3 17:51:08 racoon: INFO: received Vendor ID: RFC 3947
 Aug 3 17:51:08 racoon: INFO: received broken Microsoft ID: FRAGMENTATION
 Aug 3 17:51:08 racoon: INFO: received Vendor ID: DPD
 Aug 3 17:51:08 racoon: INFO: received Vendor ID: CISCO-UNITY
 Aug 3 17:51:13 racoon: NOTIFY: the packet is retransmitted by 192.168.1.44[500] (1).
 Aug 3 17:51:18 racoon: NOTIFY: the packet is retransmitted by 192.168.1.44[500] (1).
 Aug 3 17:51:32 racoon: ERROR: phase1 negotiation failed due to time up. 12359c6a1d26d55e:de8038828d565cab

Where 1.2.3.4 is the public IP of the pfSense box. If I connect to a network outside the public network the logs look similar. Is there something obvious that I am missing or have I misconfigured something? I have googled just about everything in this message without much luck. Thanks!

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.