Project

General

Profile

Actions

Bug #10985

closed

IPSec IKEv2 BINAT multiple Phase 2 issue

Added by Christian Wall over 4 years ago. Updated over 4 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Category:
IPsec
Target version:
-
Start date:
10/16/2020
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
Affected Architecture:
All

Description

We moved one ipsec vpn tunnel from IKEv1 to IKEv2. We have two P2 Entries and both of them are using BINAT with the same single Address:
First Entry
Left Network: 172.16.10.0/24
BINAT: 10.10.10.10/32
Right Network: 172.16.250.0/24

Second Entry:
Left Network: 10.0.9.0/24
BINAT: 10.10.10.10/32
Right Network: 172.16.250.0/24

The Connections get's established, but we cannot access the remote side when we are coming from 10.0.9.0/24.
The SPDs looks like this:
172.16.250.0/24 - 10.10.10.10 - Inbound - ESP xxx.xxx.xxx.xxx -> yyy.yyy.yyy.yyy
172.16.10.0/24 - 172.16.250.0/24 - Outbound - ESP yyy.yyy.yyy.yyy -> xxx.xxx.xxx.xxx

So the SPD for 10.0.9.0/24 is not generated.
As soon as we activate the option "Split connections" at Phase 1 it starts to work and the missing SPD for 10.0.9.0/24 get's generated.

Actions #1

Updated by Viktor Gurov over 4 years ago

  • Category set to IPsec
  • Status changed from New to Rejected

“split connections” option is used for interoperability with third party devices that do not support multiple traffic selectors on one child SA (Cisco ASA, others).

see #4704

Actions #2

Updated by Christian Wall over 4 years ago

Yes I know, but the issue is not the other side, the problem is the pfsense side.

Actions #3

Updated by Viktor Gurov over 4 years ago

Christian Wall wrote:

Yes I know, but the issue is not the other side, the problem is the pfsense side.

Please use https://forum.netgate.com/ for further discussion

Actions

Also available in: Atom PDF