Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Is VTI currently broken?

    Scheduled Pinned Locked Moved
    IPsec
    1
    1
    551
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • luckman212L
      luckman212 LAYER 8
      last edited by

      I've been trying to transition my IPSec VPNs from tunnel mode to VTI and hitting a number of issues. Examples:

      • weird fragmentation/MTU problems causing dropped packets
      • after some time, VTI gateway shows status "unknown" until dpinger is restarted
      • speed/latency issues when moving large amounts of data (apples to apples vs tunnel mode)
      • traffic sometimes completely halts until IPsec is stopped/started

      In general it feels much more unstable and so I was wondering: what is the current status & recommendation for those of us running the latest versions of pfSense (2.6/22.01 or 22.05). Are there any settings that it's critical to apply for stability?

      I also am aware of this long standing FreeBSD bug and was wondering if this could be what I'm hitting? Seems like a patch was released for FreeBSD 14 but that's a long way off. I read the caveats section of the Routed IPSec docs but this isn't mentioned.

      1 Reply Last reply Reply Quote 0
      • First post
        Last post