IPSec split connections issue



  • Hi,

    Currently on the latest beta of 2.3 and am using the split connections in IPSec functionality to connect to a Cisco ASA running 9.x. pfSense is the initiator. As you can see from the attached images there is a display issue once the tunnel is up and running. I have a couple of questions:

    1. Why is the Rekey different between 3 of the phase 2 considering they all have the same install time?
    2. If I stop the tunnel and then ping an IP in one of the four subnets only that phase 2 actually comes up, if I want to access any of the other subnets I have to manually Disconnect and Connect VPN to get all 4 phases up.

    Regards

    ![pfsense-ipsec issue pic 1.png](/public/imported_attachments/1/pfsense-ipsec issue pic 1.png)
    ![pfsense-ipsec issue pic 1.png_thumb](/public/imported_attachments/1/pfsense-ipsec issue pic 1.png_thumb)
    ![pfsense-ipsec issue pic 2.png](/public/imported_attachments/1/pfsense-ipsec issue pic 2.png)
    ![pfsense-ipsec issue pic 2.png_thumb](/public/imported_attachments/1/pfsense-ipsec issue pic 2.png_thumb)



  • @Deebs:

    1. Why is the Rekey different between 3 of the phase 2 considering they all have the same install time?

    There is randomization applied to the rekey intervals, that's correct and normal.

    @Deebs:

    1. If I stop the tunnel and then ping an IP in one of the four subnets only that phase 2 actually comes up, if I want to access any of the other subnets I have to manually Disconnect and Connect VPN to get all 4 phases up.

    That's likely due to this issue, which I just fixed.
    https://redmine.pfsense.org/issues/4719



  • That's great, will try out later today.

    Will you be fixing the visual issue?



  • What issue's that? I don't see any issues there but could be missing something.



  • The issue is in the second screenshot, I only have 1 phase 1 tunnel with 4 phase2. When connected it shows them at the top but also it still lists it at the bottom of the screen with a connect button.



  • Oh, I see what you mean. I thought at first look that was a different, unrelated connection. Yeah I'll fix that.