IPsec VPN tunnel drops consistently under heavy load (>600MB file transfers)

matiass

Hello everyone,

I’m experiencing a strange issue with an IPsec VPN setup between three pfSense firewalls configured in a full-mesh topology. The problem only affects one specific tunnel, while the other two links remain stable even under heavy traffic.

Environment

The setup consists of three pfSense appliances running different versions:

pfSense 1: 2.8.1-RELEASE
pfSense 2: 2.6.0-RELEASE
pfSense 3: 2.7.2-RELEASE
Topology
pfSense 1 (2.8.1) <--> pfSense 2 (2.6.0) <-- Problematic link

pfSense 1 (2.8.1) <--> pfSense 3 (2.7.2) <-- Works normally

pfSense 2 (2.6.0) <--> pfSense 3 (2.7.2) <-- Works normally

All Phase 1 and Phase 2 IPsec settings are identical across the three firewalls.

Basic connectivity is working correctly:

Routing is working
All remote subnets are reachable
Ping and normal traffic work without issues
Small and medium-sized transfers complete successfully
The Issue

The problem appears only when transferring larger amounts of data.

When I start a large file transfer (usually anything above 600 MB) between pfSense 1 and pfSense 2, the IPsec tunnel between them eventually drops completely.

The other two IPsec tunnels handle heavy traffic without any problems.

Troubleshooting Already Performed

I have already tested the following without success:

MTU / MSS adjustments: Lowered values and tested different settings to rule out fragmentation issues, but the tunnel still drops.
DPD (Dead Peer Detection): Modified settings and temporarily disabled DPD to make sure it was not causing false tunnel timeouts, but the behavior remained the same.
Hardware resources: Checked CPU and memory usage on both firewalls. Both remain within normal limits during the transfer.
IKE Expiration & Replacement Timers: I dug into the Phase 1 keys regeneration behavior. I experimented with adjusting the Life Time, Rekey Time, and disabling/tweaking Reauth Time , but modifying these timers did not resolve the crash.

Has anyone experienced a similar issue with mixed pfSense versions or IPsec tunnels dropping only under sustained heavy traffic?

Any suggestions on what else I should check would be greatly appreciated.

IPsec VPN tunnel drops consistently under heavy load (>600MB file transfers)

matiass

Can anyone suggest any solution ?

keyser

@matiass I would focus on the Phase 2 re-keying timers.
They are the “short” ones that happes quite often by default, so if it is a rekeying issue, those timers should “extend” the period until it dies.

But other than that, my first option would definitively be to upgrade the 2.6 box as there have been quite a lot of fixes til IPSec since then.

One other thing: Try disabling hardware acceleration is you have anything enabled on IPSec: fx. QAT, AES-NI and then make sure both ends just use IPSEC-MB crypto.

michmoor

@matiass said in IPsec VPN tunnel drops consistently under heavy load (>600MB file transfers):

pfSense 1 (2.8.1) <--> pfSense 2 (2.6.0) <-- Problematic link

Can you give system specs particulary the NIC types in use? Also how is overall system health CPU/Mem/Temps when at or near 600Mbps?