VTI IPsec with 3rd party routers that use policy routing
-
I’ve run into this issue several times when setting up an IPsec VPN with third parties who typically use policy-based VPNs on their firewalls (Cisco, Palo Alto, etc.).
On my side, I rely on SNAT/DNAT, so I need to use a routed/VTI tunnel. The problem is that these third-party firewalls expect an exactly matching Phase 2 selector. However, when using VTI, pfSense automatically adds 0.0.0.0/0, ::/0 to my proposal, which breaks the match.
Questions:
Is there a known workaround for this?
Would it be possible to add an option in the IPsec tunnel settings — e.g., a checkbox like "Don’t add 0.0.0.0/0 to the proposal" — so that existing behavior is preserved, but those of us who need exact matches can configure it accordingly?
-
@lisandromassera said in VTI IPsec with 3rd party routers that use policy routing:
On my side, I rely on SNAT/DNAT, so I need to use a routed/VTI tunnel.
Could you explain this statement, please?