Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec split connections issue

    Scheduled Pinned Locked Moved
    2.3-RC Snapshot Feedback and Issues - ARCHIVED
    2
    6
    2.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      Deebs
      last edited by

      Hi,

      Currently on the latest beta of 2.3 and am using the split connections in IPSec functionality to connect to a Cisco ASA running 9.x. pfSense is the initiator. As you can see from the attached images there is a display issue once the tunnel is up and running. I have a couple of questions:

      1. Why is the Rekey different between 3 of the phase 2 considering they all have the same install time?
      2. If I stop the tunnel and then ping an IP in one of the four subnets only that phase 2 actually comes up, if I want to access any of the other subnets I have to manually Disconnect and Connect VPN to get all 4 phases up.

      Regards

      ![pfsense-ipsec issue pic 1.png](/public/imported_attachments/1/pfsense-ipsec issue pic 1.png)
      ![pfsense-ipsec issue pic 1.png_thumb](/public/imported_attachments/1/pfsense-ipsec issue pic 1.png_thumb)
      ![pfsense-ipsec issue pic 2.png](/public/imported_attachments/1/pfsense-ipsec issue pic 2.png)
      ![pfsense-ipsec issue pic 2.png_thumb](/public/imported_attachments/1/pfsense-ipsec issue pic 2.png_thumb)

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        @Deebs:

        1. Why is the Rekey different between 3 of the phase 2 considering they all have the same install time?

        There is randomization applied to the rekey intervals, that's correct and normal.

        @Deebs:

        1. If I stop the tunnel and then ping an IP in one of the four subnets only that phase 2 actually comes up, if I want to access any of the other subnets I have to manually Disconnect and Connect VPN to get all 4 phases up.

        That's likely due to this issue, which I just fixed.
        https://redmine.pfsense.org/issues/4719

        1 Reply Last reply Reply Quote 0
        • D
          Deebs
          last edited by

          That's great, will try out later today.

          Will you be fixing the visual issue?

          1 Reply Last reply Reply Quote 0
          • C
            cmb
            last edited by

            What issue's that? I don't see any issues there but could be missing something.

            1 Reply Last reply Reply Quote 0
            • D
              Deebs
              last edited by

              The issue is in the second screenshot, I only have 1 phase 1 tunnel with 4 phase2. When connected it shows them at the top but also it still lists it at the bottom of the screen with a connect button.

              1 Reply Last reply Reply Quote 0
              • C
                cmb
                last edited by

                Oh, I see what you mean. I thought at first look that was a different, unrelated connection. Yeah I'll fix that.

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post