@jimp Thanks for the help here, makes a lot more sense now, really appreciate it!! I'm sure keep alive is working then so must be DPD or the endpoint.

@gnatbite

My solution is documented here.

https://forum.opnsense.org/index.php?topic=25957.msg125506#msg125506

@jimp said in how to enable continuous IPsec S2S reconnection retries?:

If the remote side initiates properly, it should respond.

6f8e4b12-d9e8-434f-b595-0411d595e9a5-image.png

if other side's offline time not really long pfsense responds to IPsec tunnel requests as I can said from status page above.

@jimp said in how to enable continuous IPsec S2S reconnection retries?:

The firewall tries to source it from an address inside the local part of the P2, assuming there is an address on the firewall in that subnet. If there isn't an address on the firewall in the P2 then it can't send any traffic that would trigger the tunnel to initiate.

thanks for this information, doing this immediately!

@alejjime Its on the pfSense toward the bottom of the Phase 1 page. :-)

Screenshot from 2021-12-14 22-58-57.png

Also this:

Disabled "MOBIKE" on y.y.y.y (This feature was only enabled on y.y.y.y)

@periko Thought so.
The issue is with ipsec configuration.
Pls elaborate

@craigerr1 is P2P? Mobile?
Have u open the rules in both sides to allow traffic on your firewalls->rules->ipsec?
Regards!!!

@arobin
Depends what you're trying to achieve. You didn't mention at all.

Your existing rules on A allows access from site B 10.0.10.0/24 to site A 10.100.1.0/24.

However, there is additionally a rule on DMZ at B needed for passing traffic to the remote site.

@alejjime Reviewing the pfSense configuration of my Azure network, I noticed the time zone was different than that of my client's servers, and I have already changed it, as well as that of my Windows server with the SFTP application, so they are already synchronized with my client's servers.
I made that adjustment thinking that the date/time difference might generate an asynchrony problem, but the problem persists.

@artooro said in IPSec hang with 11 P2s:

It looks like it will be quite awhile before 2.6.0 is ready for release though. So we may have to revert to 2.4.5 in the meantime.

Target for release is early next month, it's really almost done except for a few items still being worked on. Overall I'd say it's likely to be more stable than 2.5.2 for many, especially in terms of IPsec.

@nocling said in IKE2 EAP-MSCHAPv2 send pfsense DNS but windows client won't use it.:

http://woshub.com/dns-resolution-via-vpn-not-working-windows/

Interesting article, I have try and works...thanks for the info!!!

This is now sorted! Outbound NAT rules a small step that doesn't seem to be mentioned in the docs