Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    More than one IPSec tunnel phase1 is fine, but adding another phase1 prevents an existing tunnel from re-establishing a connection

    Scheduled Pinned Locked Moved IPsec
    17 Posts 4 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • lifeboyL
      lifeboy @lifeboy
      last edited by

      Has anyone here ever experienced something like this? It seems @Gblenn is experiencing the same (or very similar) behaviour as posted here.

      @jimp, is it possible that a recent upgrade introduced some bug?

      lifeboyL 1 Reply Last reply Reply Quote 0
      • lifeboyL
        lifeboy @lifeboy
        last edited by

        Interestingly: With con10 enabled I can disconnect any of the other connections and they will reconnect immediately. Only when I disconnect con5, is it not able to reconnect.

        The other connections are configured to use AES_GCM_16 (128), whereas con5 uses AES_CBC (256). Could that cause this link not to be able to re-establish ifself?

        lifeboyL 1 Reply Last reply Reply Quote 0
        • lifeboyL
          lifeboy @lifeboy
          last edited by

          Figured out what is happening, but this seems like a bug that gets triggered by something we don't know yet.

          Looking at the /var/etc/ipsec/swanctl.conf, I note the following behaviour:

          1. There are multiple active connection configured in they are listed, which the last being con10.
          2. Con10 will connect fine in this scenario.
          3. If I enable (in the pfSense UI), con9, it will be inserted into the swanctl.conf file after the con10 configuration.
          4. Once con10 is not the last connection configurated in swanctl.conf, it doesn't connect anymore.
          5. I can work around the issue by enabling con9, establishing the connection and then disabling the config. The connection stays up and then I can connect con10.

          This is not normal, but I don't know how to resolve this.

          Below is the swanctl.conf file without con9 active (I have cut the secrets and public ip's)

          # This file is automatically generated. Do not edit
          connections {
          	bypass {
          		remote_addrs = 127.0.0.1
          		children {
          			bypasslan {
          				local_ts = 192.168.131.0/24
          				remote_ts = 192.168.131.0/24
          				mode = pass
          				start_action = trap
          			}
          		}
          	}
          	con3 {
          		# P1 (ikeid 3): customer1 - link1
          		fragmentation = yes
          		unique = replace
          		version = 2
          		proposals = aes128gcm128-sha256-modp2048,aes256gcm128-sha256-modp2048
          		dpd_delay = 10s
          		rekey_time = 77760s
          		reauth_time = 0s
          		over_time = 8640s
          		rand_time = 8640s
          		encap = no
          		mobike = no
          		local_addrs = 197.214.xxx.yyy
          		remote_addrs = 105.27.aaa.bbb
          		local {
          			id = 197.214.119.130
          			auth = psk
          		}
          		remote {
          			id = 192.168.0.2
          			auth = psk
          		}
          		children {
          			con3 {
          				# P2 (reqid 9): M/Monit to Office LAN
          				# P2 (reqid 7): Unify to Office LAN
          				# P2 (reqid 6): GTS1 to Office LAN
          				mode = tunnel
          				policies = yes
          				life_time = 43196s
          				rekey_time = 38876s
          				rand_time = 4320s
          				start_action = trap
          				remote_ts = 172.16.3.0/24,172.16.3.0/24,172.16.3.0/24
          				local_ts = 192.168.131.191/32,192.168.131.177,192.168.131.174
          				esp_proposals = aes256gcm128-modp2048,aes256gcm96-modp2048,aes256gcm64-modp2048,aes128gcm128-modp2048,aes128gcm96-modp2048,aes128gcm64-modp2048
          				dpd_action = trap
          			}
          		}
          	}
          	con4 {
          		# P1 (ikeid 4): customer1 - link2
          		fragmentation = yes
          		unique = replace
          		version = 2
          		proposals = aes128gcm128-sha256-modp2048,aes256gcm128-sha256-modp2048
          		dpd_delay = 10s
          		rekey_time = 77760s
          		reauth_time = 0s
          		over_time = 8640s
          		rand_time = 8640s
          		encap = no
          		mobike = no
          		local_addrs = 197.214.xxx.yyy
          		remote_addrs = 41.164.aaa.bbb
          		local {
          			id = 197.214.xxx.yyy
          			auth = psk
          		}
          		remote {
          			id = 41.164.fff.ccc
          			auth = psk
          		}
          		children {
          			con4 {
          				# P2 (reqid 10): M/Monit to Office LAN backup
          				# P2 (reqid 8): Unify to Office LAN
          				# P2 (reqid 5): GTS1 to Office LAN
          				mode = tunnel
          				policies = yes
          				life_time = 43196s
          				rekey_time = 38876s
          				rand_time = 4320s
          				start_action = trap
          				remote_ts = 172.16.3.0/24,172.16.3.0/24,172.16.3.0/24
          				local_ts = 192.168.131.191/32,192.168.131.177/32,192.168.131.174/32
          				esp_proposals = aes256gcm128-modp2048,aes256gcm96-modp2048,aes256gcm64-modp2048,aes128gcm128-modp2048,aes128gcm96-modp2048,aes128gcm64-modp2048
          				dpd_action = trap
          			}
          		}
          	}
          	con10 {
          		# P1 (ikeid 10): Greenway Farm
          		fragmentation = yes
          		unique = replace
          		version = 2
          		proposals = aes128gcm128-sha256-modp2048
          		dpd_delay = 10s
          		rekey_time = 544320s
          		reauth_time = 0s
          		over_time = 60480s
          		rand_time = 60480s
          		encap = no
          		mobike = no
          		local_addrs = 197.214.xxx.yyy
          		remote_addrs = 165.165.bbb.ddd
          		local {
          			id = 197.214.xxx.yyy
          			auth = psk
          		}
          		remote {
          			id = %any
          			auth = psk
          		}
          		children {
          			con10 {
          				# P2 (reqid 17): Greenway server
          				# P2 (reqid 16): Greenway server
          				# P2 (reqid 15): Greenway server
          				# P2 (reqid 14): Greenway server
          				# P2 (reqid 11): Greenway server
          				mode = tunnel
          				policies = yes
          				life_time = 604800s
          				rekey_time = 544320s
          				rand_time = 60480s
          				start_action = trap
          				remote_ts = 10.10.3.0/24,10.10.4.0/24,192.168.3.0/24,10.10.2.0/24,192.168.1.0/24
          				local_ts = 192.168.153.0/24,192.168.153.0/24,192.168.153.0/24,192.168.153.0/24,192.168.153.0/24
          				esp_proposals = aes128gcm128,aes128gcm96,aes128gcm64
          				dpd_action = trap
          			}
          		}
          	}
          }
          secrets {
          	ike-0 {
          		secret = <cut>
          		id-0 = %any
          		id-1 = 192.168.0.2
          	}
          	ike-1 {
          		secret = <cut>
          		id-0 = %any
          		id-1 = 41.164.ccc.ddd
          	}
          	ike-2 {
          		secret = <cut>
          		id-0 = %any
          		id-1 = %any
          	}
          }
          
          lifeboyL 1 Reply Last reply Reply Quote 0
          • lifeboyL
            lifeboy @lifeboy
            last edited by

            Here is the scanctl.conf file with the con9 enabled:

            # This file is automatically generated. Do not edit
            connections {
                    bypass {
                            remote_addrs = 127.0.0.1
                            children {
                                    bypasslan {
                                            local_ts = 192.168.131.0/24
                                            remote_ts = 192.168.131.0/24
                                            mode = pass
                                            start_action = trap
                                    }
                            }
                    }
                    con3 {
                            # P1 (ikeid 3): customer1 - link1
                            fragmentation = yes
                            unique = replace
                            version = 2
                            proposals = aes128gcm128-sha256-modp2048,aes256gcm128-sha256-modp2048
                            dpd_delay = 10s
                            rekey_time = 77760s
                            reauth_time = 0s
                            over_time = 8640s
                            rand_time = 8640s
                            encap = no
                            mobike = no
                            local_addrs = 197.214.xxx.yyy
                            remote_addrs = 105.27.aaa.bbb
                            local {
                                    id = 197.214.xxx.yyy
                                    auth = psk
                            }
                            remote {
                                    id = 192.168.0.2
                                    auth = psk
                            }
                            children {
                                    con3 {
                                            # P2 (reqid 9): M/Monit to Office LAN
                                            # P2 (reqid 7): Unify to Office LAN
                                            # P2 (reqid 6): GTS1 to Office LAN
                                            mode = tunnel
                                            policies = yes
                                            life_time = 43196s
                                            rekey_time = 38876s
                                            rand_time = 4320s
                                            start_action = trap
                                            remote_ts = 172.16.3.0/24,172.16.3.0/24,172.16.3.0/24
                                            local_ts = 192.168.131.191/32,192.168.131.177,192.168.131.174
                                            esp_proposals = aes256gcm128-modp2048,aes256gcm96-modp2048,aes256gcm64-modp2048,aes128gcm128-modp2048,aes128gcm96-modp2048,aes128gcm64-modp2048
                                            dpd_action = trap
                                    }
                            }
                    }
                    con4 {
                            # P1 (ikeid 4): customer1 - link2
                            fragmentation = yes
                            unique = replace
                            version = 2
                            proposals = aes128gcm128-sha256-modp2048,aes256gcm128-sha256-modp2048
                            dpd_delay = 10s
                            rekey_time = 77760s
                            reauth_time = 0s
                            over_time = 8640s
                            rand_time = 8640s
                            encap = no
                            mobike = no
                            local_addrs = 197.214.xxx.yyy
                            remote_addrs = 41.164.aaa.bbb
                            local {
                                    id = 197.214.xxx.yyy
                                    auth = psk
                            }
                            remote {
                                    id = 41.164.aaa.bbb
                                    auth = psk
                            }
                            children {
                                    con4 {
                                            # P2 (reqid 10): M/Monit to Office LAN backup
                                            # P2 (reqid 8): Unify to Office LAN
                                            # P2 (reqid 5): GTS1 to Office LAN
                                            mode = tunnel
                                            policies = yes
                                            life_time = 43196s
                                            rekey_time = 38876s
                                            rand_time = 4320s
                                            start_action = trap
                                            remote_ts = 172.16.3.0/24,172.16.3.0/24,172.16.3.0/24
                                            local_ts = 192.168.131.191/32,192.168.131.177/32,192.168.131.174/32
                                            esp_proposals = aes256gcm128-modp2048,aes256gcm96-modp2048,aes256gcm64-modp2048,aes128gcm128-modp2048,aes128gcm96-modp2048,aes128gcm64-modp2048
                                            dpd_action = trap
                                    }
                            }
                    }
                    con10 {
                            # P1 (ikeid 10): Greenway Farm
                            fragmentation = yes
                            unique = replace
                            version = 2
                            proposals = aes128gcm128-sha256-modp2048
                            dpd_delay = 10s
                            rekey_time = 544320s
                            reauth_time = 0s
                            over_time = 60480s
                            rand_time = 60480s
                            encap = no
                            mobike = no
                            local_addrs = 197.214.xxx.yyy
                            remote_addrs = 165.165.bbb.ddd
                            local {
                                    id = 197.214.xxx.yyy
                                    auth = psk
                            }
                            remote {
                                    id = %any
                                    auth = psk
                            }
                            children {
                                    con10 {
                                            # P2 (reqid 17): Greenway server
                                            # P2 (reqid 16): Greenway server
                                            # P2 (reqid 15): Greenway server
                                            # P2 (reqid 14): Greenway server
                                            # P2 (reqid 11): Greenway server
                                            mode = tunnel
                                            policies = yes
                                            life_time = 604800s
                                            rekey_time = 544320s
                                            rand_time = 60480s
                                            start_action = trap
                                            remote_ts = 10.10.3.0/24,10.10.4.0/24,192.168.3.0/24,10.10.2.0/24,192.168.1.0/24
                                            local_ts = 192.168.153.0/24,192.168.153.0/24,192.168.153.0/24,192.168.153.0/24,192.168.153.0/24
                                            esp_proposals = aes128gcm128,aes128gcm96,aes128gcm64
                                            dpd_action = trap
                                    }
                            }
                    }
                    con9 {
                            # P1 (ikeid 9): Reliance Compost
                            fragmentation = yes
                            unique = replace
                            version = 2
                            proposals = aes128gcm128-sha256-modp2048,aes128-sha256-modp2048
                            dpd_delay = 10s
                            rekey_time = 544320s
                            reauth_time = 0s
                            over_time = 60480s
                            rand_time = 60480s
                            encap = no
                            mobike = no
                            local_addrs = 197.214.xxx.yyy
                            remote_addrs = 196.250.eee.fff
                            local {
                                    id = 197.214.xxx.yyy
                                            # P2 (reqid 8): Unify to Office LAN
                                            # P2 (reqid 8): Unify to Office LAN
                                            # P2 (reqid 5): GTS1 to Office LAN
                                            mode = tunnel
                                            policies = yes
                                            life_time = 43196s
                                            rekey_time = 38876s
                                            rand_time = 4320s
                                            start_action = trap
                                            remote_ts = 172.16.3.0/24,172.16.3.0/24,172.16.3.0/24
                                            local_ts = 192.168.131.191/32,192.168.131.177/32,192.168.131.174/32
                                            esp_proposals = aes256gcm128-modp2048,aes256gcm96-modp2048,aes256gcm64-modp2048,aes128gcm128-modp2048,aes128gcm96-modp2048,aes128gcm64-modp2048
                                            dpd_action = trap
                                    }
                            }
                    }
                    con10 {
                            # P1 (ikeid 10): Greenway Farm
                            fragmentation = yes
                            unique = replace
                            version = 2
                            proposals = aes128gcm128-sha256-modp2048
                            dpd_delay = 10s
                            rekey_time = 544320s
                            reauth_time = 0s
                            over_time = 60480s
                            rand_time = 60480s
                            encap = no
                            mobike = no
                            local_addrs = 197.214.xxx.yyy
                            remote_addrs = 165.165.bbb.ddd
                            local {
                                    id = 197.214.xxx.yyy
                                    auth = psk
                            }
                            remote {
                                    id = %any
                                    auth = psk
                            }
                            children {
                                    con10 {
                                            # P2 (reqid 17): Greenway server
                                            # P2 (reqid 16): Greenway server
                                            # P2 (reqid 15): Greenway server
                                            # P2 (reqid 14): Greenway server
                                            # P2 (reqid 11): Greenway server
                                            mode = tunnel
                                            policies = yes
                                            life_time = 604800s
                                            rekey_time = 544320s
                                            rand_time = 60480s
                                            start_action = trap
                                            remote_ts = 10.10.3.0/24,10.10.4.0/24,192.168.3.0/24,10.10.2.0/24,192.168.1.0/24
                                            local_ts = 192.168.153.0/24,192.168.153.0/24,192.168.153.0/24,192.168.153.0/24,192.168.153.0/24
                                            esp_proposals = aes128gcm128,aes128gcm96,aes128gcm64
                                            dpd_action = trap
                                    }
                            }
                    }
                    con9 {
                            # P1 (ikeid 9): Reliance Compost
                            fragmentation = yes
                            unique = replace
                            version = 2
                            proposals = aes128gcm128-sha256-modp2048,aes128-sha256-modp2048
                            dpd_delay = 10s
                            rekey_time = 544320s
                            reauth_time = 0s
                            over_time = 60480s
                            rand_time = 60480s
                            encap = no
                            mobike = no
                            local_addrs = 197.214.xxx.yyy
                            remote_addrs = 196.250.eee.fff
                            local {
                                    id = 197.214.xxx.yyy
                                    auth = psk
                            }
                            remote {
                                    id = %any
                                    auth = psk
                            }
                            children {
                                    con9 {
                                            # P2 (reqid 13): RC Subnet
                                            mode = tunnel
                                            policies = yes
                                            life_time = 3600s
                                            rekey_time = 3240s
                                            rand_time = 360s
                                            start_action = trap
                                            remote_ts = 192.168.0.0/24
                                            local_ts = 192.168.152.0/29
                                            esp_proposals = aes128gcm128-modp2048,aes128gcm96-modp2048,aes128gcm64-modp2048
                                            dpd_action = trap
                                    }
                            }
                    }
            }
            secrets {
                    ike-0 {
                            secret = <cut>
                            id-0 = %any
                            id-1 = 192.168.0.2
                    }
                    ike-1 {
                            secret = <cut>
                            id-0 = %any
                            id-1 = 41.164.68.170
                    }
                    ike-2 {
                            secret = <cut>
                            id-0 = %any
                            id-1 = %any
                    }
                    ike-3 {
                            secret = <cut>
                            id-0 = %any
                            id-1 = %any
                    }
            }
            

            So see now that my synopses was not quite correct. The con9 connection is now twice in the file. I suspect this causes problems?

            This seems to be a pfSense bug rather than something in the strongswan then?

            lifeboyL 1 Reply Last reply Reply Quote 0
            • lifeboyL
              lifeboy @lifeboy
              last edited by

              After some enabling and disabling, I know have only one config per configured connection in swanctl.conf, but the behaviour has not changed. I don't know why, since I didn't really make any significant changes, but that's what is like now.

              The connection for con10 cannot be established when the config for con9 is present (after the config for con10 in the file). If con10 is the last, then it can be established.

              con9 is site-to-site with a RouterOS device.
              con10 is site-to-site with a Sophos device.
              The other 2 (con3 and con4) are to a Fortigate and can be disconnected and reconnected on demand.

              @jimp, should I open a bug report for this? I don't want to make noise in redmine if it's a false alarm, so please advise if you can.

              lifeboyL 2 Replies Last reply Reply Quote 0
              • lifeboyL
                lifeboy @lifeboy
                last edited by

                This post is deleted!
                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  When something like this happens it tends to be one of two things:

                  1. There is something in the two configurations which conflicts so only one of the two is unique from strongSwan's point of view.
                  2. Something internal to strongSwan has gotten confused and you need to stop it and start it again (not restart, as that functions differently).

                  In either of those cases it's not a bug per se, so unless you can narrow it down further it likely doesn't warrant a Redmine issue since there wouldn't be anything actionable on our part.

                  Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  lifeboyL 2 Replies Last reply Reply Quote 0
                  • lifeboyL
                    lifeboy @lifeboy
                    last edited by lifeboy

                    UPDATE: After some more experimentation it turns out that the position of the connection in the config file it not relevant. If both con9 and con10 are enabled, then con9 cannot connect. When con10 is disabled (ie, removed from the config file), con9 can connect.
                    When con10 alone is in the config file, it connects succesfully, but if both con9 and con10 are present, then neither connects.

                    This is driving me a little crazy here... especially since I cannot see from the logs what the cause may be.

                    1 Reply Last reply Reply Quote 0
                    • lifeboyL
                      lifeboy @jimp
                      last edited by

                      @jimp The start vs restart is something I will do after hours tonight to see if it makes a difference. I have up to this point only used restart. I did notice that restart does not drop established connections.

                      wrt the connnection configs and a possible conflict: I have only used the UI to create these connection parameters, not didn't hack around in the swanctl.conf file. Where are the "disabled" connections stored? I have not been able to find that even with a grep search.

                      1 Reply Last reply Reply Quote 0
                      • jimpJ
                        jimp Rebel Alliance Developer Netgate
                        last edited by

                        The configuration data is all stored in config.xml which on the installation is held in /conf/config.xml.

                        Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                        Need help fast? Netgate Global Support!

                        Do not Chat/PM for help!

                        1 Reply Last reply Reply Quote 1
                        • lifeboyL
                          lifeboy @jimp
                          last edited by lifeboy

                          @jimp

                          We stopped and started the IPsec service, but the bahaviour is the same.
                          If one config is in the file, the service starts.
                          con9 present alone: con9 connects automatically (far side is RouterOS)
                          com10 present alone: con10 connects if far side is restarted manually, but not automatically (far side is Sophos).
                          If both con9 and 10 are present, neither connection starts.

                          Below are two configurations from the swanctl.conf file. There's not overlap or conflict that I can see, but maybe I'm missing something?

                               con9 {
                                      # P1 (ikeid 9): RC
                                      fragmentation = yes
                                      unique = replace
                                      version = 2
                                      proposals = aes128gcm128-sha256-modp2048,aes128-sha256-modp2048
                                      dpd_delay = 10s
                                      rekey_time = 544320s
                                      reauth_time = 0s
                                      over_time = 60480s
                                      rand_time = 60480s
                                      encap = no
                                      mobike = no
                                      local_addrs = 197.214.xxx.yyy
                                      remote_addrs = 196.250.abc.def
                                      local {
                                              id = 197.214.xxx.yyy
                                              auth = psk
                                      }
                                      remote {
                                              id = %any
                                              auth = psk
                                      }
                                      children {
                                              con9 {
                                                      # P2 (reqid 13): RC Subnet
                                                      mode = tunnel
                                                      policies = yes
                                                      life_time = 3600s
                                                      rekey_time = 3240s
                                                      rand_time = 360s
                                                      start_action = trap
                                                      remote_ts = 192.168.0.0/24
                                                      local_ts = 192.168.152.0/29
                                                      esp_proposals = aes128gcm128-modp2048,aes128gcm96-modp2048,aes128gcm64-modp2048
                                                      dpd_action = trap
                                              }
                                      }
                              }
                          
                              con10 {
                                      # P1 (ikeid 10): G
                                      fragmentation = yes
                                      unique = replace
                                      version = 2
                                      proposals = aes128gcm128-sha256-modp2048
                                      rekey_time = 544320s
                                      reauth_time = 0s
                                      over_time = 60480s
                                      rand_time = 60480s
                                      encap = no
                                      mobike = no
                                      local_addrs = 197.214.xxx.yyy
                                      remote_addrs = 165.165.cde.fgh
                                      local {
                                              id = 197.214.xxx.yyy
                                              auth = psk
                                      }
                                      remote {
                                              id = %any
                                              auth = psk
                                      }
                                      children {
                                              con10 {
                                                      # P2 (reqid 17): G server
                                                      # P2 (reqid 16): G server
                                                      # P2 (reqid 15): G server
                                                      # P2 (reqid 14): G server
                                                      # P2 (reqid 11): G server
                                                      mode = tunnel
                                                      policies = yes
                                                      life_time = 604800s
                                                      rekey_time = 544320s
                                                      rand_time = 60480s
                                                      start_action = trap
                                                      remote_ts = 10.10.3.0/24,10.10.4.0/24,192.168.3.0/24,10.10.2.0/24,192.168.1.0/24
                                                      local_ts = 192.168.153.0/24,192.168.153.0/24,192.168.153.0/24,192.168.153.0/24,192.168.153.0/24
                                                      esp_proposals = aes128gcm128-modp2048,aes128gcm96-modp2048,aes128gcm64-modp2048
                                                      dpd_action = clear
                                              }
                                      }
                              }
                          
                          1 Reply Last reply Reply Quote 0
                          • jimpJ
                            jimp Rebel Alliance Developer Netgate
                            last edited by

                            Your problem is almost certainly because both of those have a remote ID of %any and are using pre-shared keys.

                            strongSwan references pre-shared keys by associating them with a remote identifier. With both of those tunnels enabled, it would have both keys listed for the %any ID, so it's unpredictable which (if either) would ever match.

                            Fix the remote IDs and both will probably work.

                            Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                            Need help fast? Netgate Global Support!

                            Do not Chat/PM for help!

                            M lifeboyL 2 Replies Last reply Reply Quote 2
                            • M
                              michmoor LAYER 8 Rebel Alliance @jimp
                              last edited by

                              @jimp nice.
                              i have been following this out of curiosity. I have been a bit worried about the stability of IPsec on the platform based on my current experience so this has been an interesting post to follow. I would've never thought about the remote id being a problem. Makes sense

                              Firewall: NetGate,Palo Alto-VM,Juniper SRX
                              Routing: Juniper, Arista, Cisco
                              Switching: Juniper, Arista, Cisco
                              Wireless: Unifi, Aruba IAP
                              JNCIP,CCNP Enterprise

                              G 1 Reply Last reply Reply Quote 0
                              • lifeboyL
                                lifeboy @jimp
                                last edited by

                                @jimp, you're quite correct about the peer identifier. (No surprise there! ๐Ÿ˜ )

                                Thanks for pointing that out. Although we need to finally test the one link after hours tonight, the "g" link is already working with both configs enabled.

                                1 Reply Last reply Reply Quote 0
                                • G
                                  Gblenn @michmoor
                                  last edited by

                                  @michmoor said in More than one IPSec tunnel phase1 is fine, but adding another phase1 prevents an existing tunnel from re-establishing a connection:

                                  @jimp nice.
                                  i have been following this out of curiosity. I have been a bit worried about the stability of IPsec on the platform based on my current experience so this has been an interesting post to follow. I would've never thought about the remote id being a problem. Makes sense

                                  Indeed an interesting finding and definitely something to investigate to see if it resolves my issue...

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.