IKE algorithm not matching in backup HA node

[gesture1968]

Hi,

Having a 2-node cluster and about 30 Site-2-Site VPN connections, after a failover from the primary to the backup node, only about 5 S2S connections are active, while all others are in connecting mode. I've looked at the IPSec log and what strikes me is that all failing connections get the following error:

May 31 08:58:20 charon 05[IKE] <6547>  x.x.x.x is initiating a Main Mode IKE_SA
May 31 08:58:20 charon 05[CFG] <6547> received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
May 31 08:58:20 charon 05[CFG] <6547> configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 May 31 08:58:20 charon 05[IKE] <6547> no proposal found

It's the bold lines that are not correct, as all connections ARE configured using AES256, but somehow the backup node thinks that it is configured using AES128…!? I've doublechecked and all connections are configured as AES256. The primary node is configured this way, so because of the HA, the backup has the same config, and the primary is connecting fine after it's up again and resuming it's primary role. It's just the backup node that is incorrectly assuming a different phase1 AES algorithm. Can this be a bug?

I'm using PFsense 2.3.1_1

Greetings,
Gesture