IPSec split connections issue

[Deebs]

Hi,

Currently on the latest beta of 2.3 and am using the split connections in IPSec functionality to connect to a Cisco ASA running 9.x. pfSense is the initiator. As you can see from the attached images there is a display issue once the tunnel is up and running. I have a couple of questions:

1. Why is the Rekey different between 3 of the phase 2 considering they all have the same install time?
2. If I stop the tunnel and then ping an IP in one of the four subnets only that phase 2 actually comes up, if I want to access any of the other subnets I have to manually Disconnect and Connect VPN to get all 4 phases up.

Regards


[cmb]

@Deebs:

1. Why is the Rekey different between 3 of the phase 2 considering they all have the same install time?

There is randomization applied to the rekey intervals, that's correct and normal.

@Deebs:

2. If I stop the tunnel and then ping an IP in one of the four subnets only that phase 2 actually comes up, if I want to access any of the other subnets I have to manually Disconnect and Connect VPN to get all 4 phases up.

That's likely due to this issue, which I just fixed.
https://redmine.pfsense.org/issues/4719

[Deebs]

That's great, will try out later today.

Will you be fixing the visual issue?

[cmb]

What issue's that? I don't see any issues there but could be missing something.

[Deebs]

The issue is in the second screenshot, I only have 1 phase 1 tunnel with 4 phase2. When connected it shows them at the top but also it still lists it at the bottom of the screen with a connect button.

[cmb]

Oh, I see what you mean. I thought at first look that was a different, unrelated connection. Yeah I'll fix that.