Warning about IKEV2 with multiple phase 2s not working bug
-
I wanted to contribute some info here that may save some poor soul many hours. I have an IPSEC connection to a client that required two phase 2 definitions due to multiple subnets. We could not get it working after 2 days. They had a Cisco ASA so we got Cisco involved, after a few hours the person stated the error was due to having only one SA for the tunnel and he was aware of a Strongswan/Pfsense problem. He said it was due to Strongswan not providing 2 SAs for IKEV2. Sure enough, we went to IKEV1 and all was well. A few days later I found https://redmine.pfsense.org/issues/6324 which was exactly the problem. I don't know if I should post there since I am new to Pfsense and not a developer, but figured I might save someone headaches someday if I post here.
-
It is a limitation in the ASA. Enable split connections. 6324 is something different.
-
OK, but theirs is an ASA 5545 and the Cisco guy said the single SA was a known Strongswan problem in the Cisco database. I don't know anything about the Cisco stuff and will run the "enable split connections" by them but most likely to stay on IKEV1 since it takes a lot to get the client to work on this. Thanks!
-
Again. Not a bug in StrongSwan or pfSense but a limitation in the ASA for which there is a workaround. That Split Connections checkbox exists specifically to work around the limitation in the ASA's IKEv2.
-
Thanks for clearing that up! I sent the client a link to this thread which I hope they share with the Cisco person.