1. only one road warrior is affected. Five others connect without any problems.
2. I couldn't access his machine today, so I can't say for sure if his setup is correct.
3. CHILD_SA is established. The initiation looks like for a properly working client.
4. This client tries to access internal servers with his public ISP IP, instead of the one provided by pfsense. He gets a virtual IP assigned and traffic selectors look good in pfSense log.

Does anyone happen to know this error? TIA!

Chris