IPSec split connections issue
-
Hi,
Currently on the latest beta of 2.3 and am using the split connections in IPSec functionality to connect to a Cisco ASA running 9.x. pfSense is the initiator. As you can see from the attached images there is a display issue once the tunnel is up and running. I have a couple of questions:
- Why is the Rekey different between 3 of the phase 2 considering they all have the same install time?
- If I stop the tunnel and then ping an IP in one of the four subnets only that phase 2 actually comes up, if I want to access any of the other subnets I have to manually Disconnect and Connect VPN to get all 4 phases up.
Regards



 -
- Why is the Rekey different between 3 of the phase 2 considering they all have the same install time?
There is randomization applied to the rekey intervals, that's correct and normal.
- If I stop the tunnel and then ping an IP in one of the four subnets only that phase 2 actually comes up, if I want to access any of the other subnets I have to manually Disconnect and Connect VPN to get all 4 phases up.
That's likely due to this issue, which I just fixed.
https://redmine.pfsense.org/issues/4719 -
That's great, will try out later today.
Will you be fixing the visual issue?
-
What issue's that? I don't see any issues there but could be missing something.
-
The issue is in the second screenshot, I only have 1 phase 1 tunnel with 4 phase2. When connected it shows them at the top but also it still lists it at the bottom of the screen with a connect button.
-
Oh, I see what you mean. I thought at first look that was a different, unrelated connection. Yeah I'll fix that.