i'm currently building a s2s VPN using 2 pfsense appliances (2.0.2). the tunnel gets build but i'm unable to route traffic from one side to the other, check my testlab:

Okay, i build a fresh testlab to narrow the error down. Here's what i'm doing:

• to be sure it's not a version problem, i switched to pfsense 2.0.1
• Network A: 192.168.3.0/24
• Network B: 192.168.2.0/24
• "Internet simulation network": 10.10.10.0/24

PFSense Site A:

• em0: WAN, 10.10.10.10
• em1: LAN, 192.168.3.10

Client Site A:

• if0: LAN, 192.168.3.100, gw: 192.168.3.10
• Firewall disabled, pinging gw works.

PFSense Site B:

• em0: WAN, 10.10.10.20
• em1: LAN, 192.168.2.20

Client Site B:

• if0: LAN, 192.168.2.100, gw: 192.168.2.20
• Firewall disabled, pinging gw works.

PFSense Site B configuration:

• ALL Firewall rules on EVERY SINGLE interface set to allow any
• no GW or routes added, so only the default interface networks are known to pfsense
• test CA created using the pfsense gui
• server (type: server) certificate created using the pfsense gui and the created ca
• client (type: user) certificate created using the pfsense gui
• exported private and public key of the client cert
• exported public key of the CA cert
• created a new Open VPN server NOT using the wizard but clicking "add" (since i want a peer to peer OVPN which the wizard dosnt offer)
• configured it like this: #Server Mode: Peer to Peer (SSL / TLS) #Protocol TCP #Device Mode: TUN #Interface: WAN #Port 443 #Disabled TLS Auth for testing #Using the created CA and the created server cert. # default crypto #Tunnel Network: 172.16.0.0/24

  Local Network: 192.168.2.0/24 #Remote Network: 192.168.3.0/24 #Concurrent connections: 2 #rest default / blank

• added new interface OPT1 (ovpnc1)
• enabled the OTP1 interface (type: none)
• yes: FW rules on the OVPN interfaces are also set to allow ANY TO ANY
• disabled and re-enabled the openvpn server
• checked routes: routes to the remote network are present using the ovpnc1 NIC

PFSense Site A configuration:

• ALL Firewall rules on EVERY SINGLE interface set to allow any
• no GW or routes added, so only the default interface networks are known to pfsense
• imported the CA from Site B using its public key
• imported the Client cert vom Site B using its public and private key
• created a new Open VPN client by clicking the "add" icon in the open vpn client section
• configured it like this:

• Server Mode: Peer to Peer (SSL / TLS) #Protocol TCP #Device Mode: TUN #Interface: WAN #Port 443 #Server host or address: 10.10.10.20

  Server port: 443 #Disabled TLS Auth for testing #Using the imported CA and the imported client cert. # default crypto #Tunnel

  Network: 172.16.0.0/24 #Remote Network: 192.168.2.0/24 #rest default / blank
• added new interface OPT1 (ovpnc1)
• enabled the OTP1 interface (type: none)
• yes: FW rules on the OVPN interfaces are also set to allow ANY TO ANY
• disabled and re-enabled the openvpn server
• checked routes: routes to the remote network are present using the ovpnc1 NIC

--> VPN tunnel comes up and i see the up-state on both pfsense ends. NOTHING ELSE was configured in pfsense

Testing:

Client on site A is unable to ping client on site B and vice versa. pathping shows the route ends at the gw of the client (PFSense LAN port).

PFSense on site A is unable to ping client on site B using LAN and WAN interface, but successfull using the OTP1 interface. However, client on site B is unable to ping PFSense on site A.

This however is not true for pinging from PFSense on site B to the client on site A: ping dosn't work from any interface. Here again: pinging PFSense on site B from client on site A fails.

Also PFSense on site B is unable to ping client on site A and vice versa. Tested using the WAN, LAN and OTP1 interfaces to send the pings out.

Strange: PFsense on site A is able to ping PFSense on site B, but not vice versa!

Result:

Only the direct client, which is pfsense on site A, seems to be able to talk to ANYTHING on the remote network (pfsense or any client). clients which try to route via pfsense fail communicating, even tought they're on the same subnet as pfsense so the network should be kown to the remote site. also communication STARTING on the server site (B) seems not to reach anything on the client site (A).

This brings up two questions: - How do i tell PFsense / OpenVPN to also VPN transport traffic from any client that routes via pfsense (from the same subnet) (i guess NAT would work but is there really no other way?) - How do i allow traffic which is generated on my server site (B) to go via VPN to the client site?

Edit Nr. 2

I added this to the advanced config on the server side with no effect other then described above in the tests:

route 192.168.2.0 255.255.255.0;push "route 192.168.3.0 255.255.255.0";

also, using pfsense 2.0.1 i realized that when the vpn connection gets established i now have a gateway with the IP of the ovpn interface added to my gateways, which alowed me to add a static route to the remote network using that interface. i did this on both: site A and site B (or client and server if you like so).

Edit Nr. 3

here the screens showing the routes: Site B (server) routes:

Site A (client):

i'm currently rolling vCloud Director and run into some strange issues. As you might know, in vCloud Director Provider vCDs use vSphere ressource pools. The problem is that if you temporarily disable DRS in vSphere all your ressource pools get lost, what happend to me. They seem not to be rebuild after re-enableing DRS. Now i'm stranded with some old provider vCDs without active ressource pools. However, i can't "change" those old vCDs and add new ressource pools since vCloud Director tells me something like "unable to change vCD settings because something is wrong with the vCD" - yeh, tell me something i don't know.

However: I then created new Provider vCDs and moved all ressources from the old provider to the new one. then I wanted to delete the old providers, which is impossible since they still have 1. a edge gateway and i can't delete the edge gateways since they have 2. a organisation network, which I can't delete because - well: it dosn't tell me why exacly (but no vm's, snapshots or vApps use that network!)

So, I deleted the edge and the network using vShield Manager and made sure nothing is left in vSphere as well. However: the stranded provieder vCDs still show up the network and the edge (which are not existent which is why I can't delete them )

Please note that those objects do not show up in the "stranded items" section, where a force delete would be possible. I just call them "stranded" because vmware is using this term for broken object links.

So, my question is qute simple: how do I forcefully remove a vCD Provider / Edge-Gateway / Org. network vom vCloud director if it's not showing up in the stranded section and normal deletion fails?

I was lurking around the VCloud SQL database but was unable to find the needed table entries. However, manually editing the SQL should be the LAST RESORT. I can't belive there is no way to force a object deletion.

Any ideas?

I'm trying to issue a new certificate using the additional attribues field within the Windows CertSrv Web-Enrollment Client.

I added the CSR, picked the template and entered this into the attributes field:

SAN:dns=HOSTNAME&dns=HOSTNAME.DOMAIN.COM&ipaddress=IPADRESS

The request is successful but when I check the signed certificate no "Alternative Names" attribute is added to it. Am I missing something? Maybe a issue with the Template? (used a default Win 2003 level webserver template copy with some custom settings).

/edit Also I've tried to use

certreq -submit -attrib "CertificateTemplate:MYTEMPLATE" <Cert Request.req> -attrib "SAN:dns=HOSTNAME&dns=HOSTNAME2&ipaddress=IPADDRESS"

resulting in the same problem: cert gets generated, but without any SAN attribute.

/edit2 also I've set the CA to issue SAN certificates using

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2

and restarting the CA service. Still: no SANs.

Please note: using req. files and OpenSSL to generate the CSR i'm able to generate certifcates using the CA which have some SANs included. However this option is not valid in my current situation since I'm getting the CSR from an application and i'm not able to manually generate one for the application.

/edit3 I tried using the default webserver certificate WITHOUT any changes and suddenly it worked. So now the question is: what are the template requirements to enable SAN?

i was wondering if the routing mechanism for LACP (source / destination MAC, source+destination MAC, source / destination IP, source+destination IP) has to be the same within

• one LACP trunk* between two devices
• multiple LACP trunks* but one logical path across multiple devices

also: when using auto LACP, does a negotiation happen so the devices automatically use the same routing strategie? what's the worst that could happen if the routing mechanisms don't fit?

*I'm using the term "trunk" here in the means of "grouping multiple physical cables for the goal of redundancy and higher troughput"

Currently i'm working with ADFS to establish a federated trust between two separated domains.

My question is simple: does ADFS v. 2.0 support transitive trust across federated identity providers? And if so, see the questions below. (I'm not talking about AD forest trusts but about compleatly separated domains using pure ADFS 2.0 in a federation scenario)

I know that ADFS v 1.0 does not, as stated in this document on page 9. But when looking on the claims rules that come with ADFS 2.0 it seems to be possible, as a Microsoft partner confirmed. However: the documentation on this topic is a mess! Simply no ADFS v. 2.0 related statements on this topic that i was able to find (IF you got any documentation on this PLEASE help me out guys!).

To be more clear, lets assume this scenario:

Federation provider (A) trust federation provider (B) which trusts identity provider (C).
So, does (A) trust identities comming from (C) across (B)?

Fruther questions in case of support of transitive trust:

• Is it possible to restrict the transitive trust in ADFS in any way? If so, how? (Powershell Command or ADFS GUI menü entry where to find it)
• How does the transitive trust affect the Issuer and OriginalIssuer properties of the claims?
• If transitive trust is used together with claims transformations and provider (B) would transform incomming claims from (C) in a way that they are transformed into (new) claims of same type an value, how would this affect the Issuer and OriginalIssuer properties?

IMPORTANT: whether it's supported or not, I need some official sources on this. However, if nobody else will be able to provide them and someone is able to answer the questions with his experience, i'm willed to give the bounty to him / her even without official sources.

i got a little trouble with a test setup i want to do using Hyper-V. Its supposed to be running within an active domain network. I want to setup a DC and other Servers - so normaly i would choose a internal or private network. However: I also want to be able to access the VMs using RDP, thisfor i would have to use a external network configuration. But if i do so there would be two DCs and two DHCPs in the network, which would cause trouble.

So, my question: is there any way to realize what i want to do or do i have to use the Hyper-V Manager to access the VM's?