Multiple identical Child SA entries

  • After updating to 2.4.2 I noticed multiple identical child SA's as shown in the screenshot. This is an IPSEC IkEv2 connection between 2 pfsense boxes, it is shown on both sites in the status.
    After a forced disconnect/connect it will start just fine with only one child SA (with multiple traffic selectors inside) and after a while  it starts growing.
    I'm not sure it will cause any troubles, wonder how it will behave if it really starts to pile up. Strange thing is I only see this on this connection, have a bunch of others (both IkEv1 as v2) where it doesn't seem to happen.
    Any ideas? Anyone else seeing this? Will it do any harm?
    ![pfsense child SA.jpg](/public/imported_attachments/1/pfsense child SA.jpg)
    ![pfsense child SA.jpg_thumb](/public/imported_attachments/1/pfsense child SA.jpg_thumb)

  • Seems to be solved by disableing DPD on both sites, however don’t understand why….

Log in to reply