Disabling IPSEC tunnel doesn't remove route
-
IPSEC tunnel creates route to endpoint IP address on defined interface. After disabling IPSEC tunnel route is not being removed. In single WAN environment that is not an issue as there is only one WAN and all traffic will go trough that interface. So that route and default route will be always on the same interface. However, that is an issue in multi WAN environment. Traffic to that specific IP address will be forced trough, let's say for example, WAN1 even if default route is going to WAN2 interface. For example, in failover configuration, if WAN1 goes down all traffic will be directed to WAN2 except traffic for IP address defined in IPSEC tunnel settings despite that tunnel being disabled. Restarting IPSEC doesn't remove that route, Either rebooting pfsense or manually removing route trough CLI will fix it.
Is that intended behavior or bug? If it's intended behavior can someone explain reasoning behind that. I lost hours on that and customer was partially down not being able to reach exchange server for good portion of the day until I figured out what was going on. I was able to replicate the same behavior on my setup as well.