Bug #4188
closed
IPSec SA requestid has limited range in FreeBSD
100%
Description
FreeBSD allows up to ~16000 range of reqid on the SAs specified manually.
There are problems with the IPsec SA tracking of strongswan since pfSense specifies manually them to be able to track the various tunnels in the status page.
This becomes a problem since for requests with multiple phase2 the reqid is multiplied by 1000 to be able to track things.
Either the kernel should be patched to increase the range or there should be found another way to track the tunnel status.
Updated by Ermal Luçi over 9 years ago
- Priority changed from Normal to Very High
Updated by Ermal Luçi over 9 years ago
- Status changed from Confirmed to Feedback
- % Done changed from 0 to 100
Applied in changeset 4a3ce17a7e3926cce3bf2671965096db78f95932.
Updated by Ermal Luçi over 9 years ago
Applied in changeset f8e23dc8c4f6c333621e4fb44e8fc1f3ef1dd60c.
Updated by Chris Buechler over 9 years ago
- Status changed from Feedback to Resolved
confirmed the new snapshot with this fix fixes the circumstances where we were seeing this.
Updated by Ermal Luçi over 9 years ago
Just need to check if the IKEv1 tunnels with many phase2 are still usable with pfSense to some other product Chris.
Can you make sure of that as well please?
Updated by Pi Ba over 9 years ago
This broke https://redmine.pfsense.org/issues/4129 again.. it really needs different reqid's for each P1 if unity is not supported by the remote device.. maybe not include the '00' in there, but make it unique in another way?
Updated by Chris Buechler over 9 years ago
- Status changed from Resolved to Confirmed
yeah this did break that scenario