Azure site to site VPN to OPNSense VPN

Max Ricketts 40

I have an Azure Site to Site VPN to an OPNSense using IPsec. I have tried a multitude of configurations and its not quite working. When I manually start the VPN it states that it is up in OPNSense but no data is being transferred. If I use ssh on a device on-prem to a vm in azure it opens the connection and I can log on to the azure VM. After while it seems the connection stops (still shows as up in OPNSense and Azure) If i try to ssh from the azure VM to the device on-prem it doesn't work and the connection times out. If I do the reverse again (on prem VM to azure vm) and try to ssh the connection opens and all is ok for a while.

UDP ports 500 and 4500 are allowed through the OPNSense Firewall rules

Here are my current settings. I have tried many.

OPN Sense - Version 24.7.4_1-amd64

Phase 1
Proposals - aes256-sha384-ecp384[DH20, NIST EC]
Version - IKEv2
MOBIKE - checked
Re-auth time - 86400
Re-key - 1440
DPD Delays - 30
DPD Timeout - 120

Phase 2
aes256gcm16-sha256-ecp384[DH20, NIST EC]
Policies - enabled
Start action - Start
Close action - None
DPD action - Start
Rekey time - 14400

Azure connection configs
Phase1
Encryption - AES256
Integrity/PRF - SHA384
DH Group - ECP384

Phase 2
IPSec Encryption - GCMAES256
IPSec Integrity - GCMAES256
PFS Group - ECP384

IPSec SA lifetime in seconds - 86400
DPD timeout - 45

Connection mode - Default.

Has anyone seen or have this combination of Azure Network gateway and OPNSense Firewall working well.

The only way I can keep the connection up is using a device on-prem doing an icmp request to a device in azure.

Kind regards

Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-15T18:58:52.06+00:00
Hi Max Ricketts,

Greetings,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

It sounds like you're facing a challenging issue with your Azure Site-to-Site VPN connection to OPNSense using IPsec.

Currently The circumstances: VPN Status: Data transit is irregular, although the VPN appears to be "up" on OPNSense and Azure.

SSH Connectivity: After a while, you won't be able to SSH from an Azure virtual machine to an on-premises system.

Firewall Rules: The OPNSense firewall permits traffic on UDP ports 500 and 4500.

Keep-Alive: Only when ICMP requests are delivered from on-premises to Azure does the connection stay steady.

To further troubleshoot the issue:

Adjust IPsec SA Lifetime:

Consider reducing the IPSec SA lifetime on both sides to 3600 seconds (1 hour) instead of 86400 seconds. This can help in re-establishing the connection more frequently.

Review Firewall Rules: Ensure that there are no other firewall rules on OPNSense that might be blocking traffic after the initial connection is established. Check for any stateful rules that might be affecting the return traffic.

Packet Capture:

Perform packet captures on both the OPNSense and Azure sides to analyze the traffic. Look for any dropped packets or errors that might indicate where the connection is failing. Workaround

ICMP Keep-Alive: While using ICMP requests to keep the connection alive is a temporary solution, it indicates that the connection is dropping due to inactivity. Focus on resolving the underlying issues to avoid relying on this workaround.

Recreating the VPN Connection: Sometimes starting fresh with a new configuration can help eliminate hidden issues.

Please ask if you need any more help or explanation on any of the interprets!

With regards,

Ganesh
Max Ricketts 40 Reputation points

2024-10-16T08:50:20.2233333+00:00

Thank you for the reply. I will go through this and test and let you know.
Max Ricketts 40 Reputation points

2024-10-16T14:12:45.6433333+00:00

The Azure DPD settings in azure I change to 120 which is what is what is configured on a VPN that is connecting UPCloud to OPNsense which works all ok.

I also changed the other settings as you suggested.

After a restart of the VPN service VM in Azure still can't initiate the connections to on-prem. But the other way round VM on prem trying to SSH to Azure creates the connection.

I'll look into the packet capture on the azure side as well and see what I can see. Seems like this should be a simple solution to setup. We have configured these in AWS and UPcloud to OPNSense with no issues.
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-18T15:02:04.9533333+00:00

Hello Max Ricketts,

Greetings of the day!

I would like to follow up with the thread.

Just checking in to see if you had a chance to see my response to your question. Please tell us if it was helpful and feel free to reach out to us if you have any queries.

Looking forward to your response and appreciate your time on this.

Cheers,

Ganesh
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-21T17:39:46.45+00:00

Hello Max Ricketts,

Greetings of the day!

I would like to follow up with the thread.

Just checking in to see if you had a chance to see my response to your question. Please tell us if it was helpful and feel free to reach out to us if you have any queries.

Looking forward to your response and appreciate your time on this.

Cheers,

Ganesh
Max Ricketts 40 Reputation points

2024-10-22T07:48:26.2066667+00:00

Hi Ganesh,

Can you give me some guidance with the diagnostic logs. I have them all on but not really sure what I am looking for.

Kind regards

Max
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-23T16:57:08.09+00:00
Hey Max Ricketts,

We appreciate your patience!

Can you ping on prem IP from azure and see whether it is reaching or not.

From On-prem also ping azure vpn gateway IP and check the IKE logs.

If Traffic reaches azure VPN IP, then try to do VPN gateway reset.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

Hope this clarifies,Thanks

Ganesh
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-24T16:00:22.2433333+00:00

Hey Max Ricketts,

I hope you are doing well

Just checking in to see if you have got a chance to see my response to your question in resolving the issue.

If you are still facing any further issues, please don't hesitate to reach out to us. We are happy to assist you.

Looking forward to your response and appreciate your time on this.

Regards,

Ganesh
Max Ricketts 40 Reputation points

2024-10-25T08:02:46.7866667+00:00

I will be looking at this first thing next week. Again appreciate your help on this.
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-25T14:48:40.7533333+00:00
Hello Max Ricketts,

We appreciate your patience!

Please let me know once you tried this.

We are happy to assist you.

Regards,

Ganesh
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-28T10:36:36.23+00:00
Hello Max Ricketts,

We appreciate your patience!

Please let me know once you tried this.

We are happy to assist you.

Regards,

Ganesh
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-29T15:18:22.3333333+00:00
Hello Max Ricketts,

We appreciate your patience!

Please let me know once you tried this.

We are happy to assist you.

Regards,

Ganesh
Max Ricketts 40 Reputation points

2024-10-30T14:16:59.53+00:00

Hoping to test and look at the logs shortly. Priorities have come in.
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-11-01T09:37:00.45+00:00
Hello Max Ricketts,

We appreciate your patience!

Please let me know once you tried this.

We are happy to assist you.

Regards,

Ganesh
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-11-05T14:51:53.7+00:00
Hello Max Ricketts,

We appreciate your patience!

Please let me know once you tried this.

We are happy to assist you.

Regards,

Ganesh
Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-11-06T15:42:00.2866667+00:00
Hello Max Ricketts,

We appreciate your patience!

Please let me know once you tried this.

We are happy to assist you.

Regards,

Ganesh

Accepted answer

Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-10-17T15:18:02.85+00:00
Hello Max Ricketts,

We appreciate for your Patience!

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I have no idea about your On-prem device, and I will not recommend any suggestions for your On-prem device but from azure side these are the logs available you check it out here in below:

Validated VPN devices and device configuration guides:

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices#devicetable

I don't see it in the validated devices "OpenSense VPN".

I will mostly recommend you to please check the azure Diagonostic logs in below.

GatewayDiagnosticLog

TunnelDiagnosticLog

RouteDiagnosticLog

IKEDiagnosticLog

P2SDiagnosticLog

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

Can you ping on prem IP from azure and see whether it is reaching or not.

From On-prem also ping azure vpn gateway IP and check the IKE logs.

If Traffic reaches azure VPN IP, then try to do VPN gateway reset.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

Hope this clarifies,

Thanks

Ganesh

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.
Max Ricketts 40 Reputation points

2024-11-12T14:09:49.5333333+00:00

I have not been able to change anything. But the ping check that was keeping the connection alive went down over a week ago and the VPN has stayed up. So all is working as it should and no config changes have happened. Magic

Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-11-12T14:24:26.5166667+00:00

Hi Max Ricketts,

Greetings!

As I can see your comment that the issue has been resolved.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Cheers,

Ganesh

Your contribution is highly appreciated.

Ganesh Patapati 1,745 Reputation points Microsoft Vendor

2024-11-12T15:09:05.9533333+00:00

Hi Max Ricketts,

Greetings!

As I can see your comment that the issue has been resolved.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Cheers,

Ganesh

Your contribution is highly appreciated.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure site to site VPN to OPNSense VPN

0 additional answers

Your answer