Mobile IPsec works only on second try

[marcol]

Hi,
we are currently running two pfSenses SG-4860 wit HA-sync and have mobile IPsec configured on it. Since we thought using the integrated IPsec client in Windows would be nice, we also configured radius-authentication towards our AD in addition to the certificate based authentication on pfSense.
We are experiencing a strange behaviour though, when connecting to the VPN. The first time you connect it all looks good, but no traffic is flowing. After some research I found out that actually two P2 tunnels get created, one with PFS and one without. After disconnecting and connecting the VPN, this behaviour is not shown and the tunnel works fine. The behaviour reappears after restarting the Client (Win 10 or Win 7 does not matter) or disabling and re-enabling wifi for example. The connection was created using Powershell and adding the "use windows-credentials" parameter afterwards, since it does not accept it when creating IKEv2 tunnels with Powershell.

I've attached three screenshots where you can see the creation of the connection and the two P2s getting created.

Connection with the error happening:

Connection without the error:

Any suggestions how he may mitigate this error?

Thanks in advance

Marco