pfSense

Plataform:

Version 2.5.1-RELEASE (amd64) on VMWare
built on Mon Apr 12 07:50:14 EDT 2021
FreeBSD 12.2-STABLE
FreeBSD strongSwan U5.9.1/K12.2-STABLE

Description:
Menu Status->IPSec->Overview, "Disconnect Button" should only disconnect one user but it is dropping all mobile active connections (hundreds).
The problem occurred after upgrading from version 2.4.5 to 2.5.1.

We did a test in a second instance of PfSense and the problem repeated itself. The problem occurred on two different VPNs servers with the same version of PFSense.
Also, we tested killing a connection with the command "swanctl -t" and it worked perfectly, dropping only the target connection and not the others , as it happens in the PfSense GUI:

swanctl -t --ike-id 3880

[IKE] deleting IKE_SA con-mobile³⁸⁸⁰ between [x.x.x.x]...y.y.y.y
[IKE] sending DELETE for IKE_SA con-mobile³⁸⁸⁰
[ENC] generating INFORMATIONAL request 2 [ D ]
[NET] sending packet: from x.x.x.x⁴⁵⁰⁰ to y.y.y.y⁴⁵⁰⁰ (80 bytes)
[NET] received packet: from y.y.y.y⁴⁵⁰⁰ to x.x.x.x⁴⁵⁰⁰ (80 bytes)
[ENC] parsed INFORMATIONAL response 2 [ ]
[IKE] IKE_SA deleted
terminate completed successfully

So far, evidence seems to point to a BUG in PfSense management scripts.

Thanks,

Geovane

Jun 15 10:02:14 vpn4 charon⁷¹⁰¹¹: 15[IKE] <con-mobile|2722> sending DELETE for IKE_SA con-mobile²⁷²²
Jun 15 10:02:14 vpn4 charon⁷¹⁰¹¹: 13[IKE] <con-mobile|2690> sending DELETE for IKE_SA con-mobile²⁶⁹⁰
Jun 15 10:02:14 vpn4 charon⁷¹⁰¹¹: 07[IKE] <con-mobile|2642> sending DELETE for IKE_SA con-mobile²⁶⁴²
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 12[IKE] <con-mobile|2602> sending DELETE for IKE_SA con-mobile²⁶⁰²
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 11[IKE] <con-mobile|2592> sending DELETE for IKE_SA con-mobile²⁵⁹²
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 11[IKE] <con-mobile|2924> sending DELETE for IKE_SA con-mobile²⁹²⁴
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 11[IKE] <con-mobile|2922> sending DELETE for IKE_SA con-mobile²⁹²²
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 07[IKE] <con-mobile|2889> sending DELETE for IKE_SA con-mobile²⁸⁸⁹
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 10[IKE] <con-mobile|2884> sending DELETE for IKE_SA con-mobile²⁸⁸⁴
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 07[IKE] <con-mobile|2882> sending DELETE for IKE_SA con-mobile²⁸⁸²
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 07[IKE] <con-mobile|2859> sending DELETE for IKE_SA con-mobile²⁸⁵⁹
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 15[IKE] <con-mobile|2820> sending DELETE for IKE_SA con-mobile²⁸²⁰
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 13[IKE] <con-mobile|2812> sending DELETE for IKE_SA con-mobile²⁸¹²
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 13[IKE] <con-mobile|2798> sending DELETE for IKE_SA con-mobile²⁷⁹⁸
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 08[IKE] <con-mobile|2650> sending DELETE for IKE_SA con-mobile²⁶⁵⁰
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 06[IKE] <con-mobile|2613> sending DELETE for IKE_SA con-mobile²⁶¹³
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 12[IKE] <con-mobile|2909> sending DELETE for IKE_SA con-mobile²⁹⁰⁹
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 10[IKE] <con-mobile|2878> sending DELETE for IKE_SA con-mobile²⁸⁷⁸
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 09[IKE] <con-mobile|2857> sending DELETE for IKE_SA con-mobile²⁸⁵⁷
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 11[IKE] <con-mobile|2836> sending DELETE for IKE_SA con-mobile²⁸³⁶
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 07[IKE] <con-mobile|2827> sending DELETE for IKE_SA con-mobile²⁸²⁷
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 09[IKE] <con-mobile|2819> sending DELETE for IKE_SA con-mobile²⁸¹⁹
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 09[IKE] <con-mobile|2794> sending DELETE for IKE_SA con-mobile²⁷⁹⁴
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 09[IKE] <con-mobile|2727> sending DELETE for IKE_SA con-mobile²⁷²⁷
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 10[IKE] <con-mobile|2579> sending DELETE for IKE_SA con-mobile²⁵⁷⁹
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 10[IKE] <con-mobile|2903> sending DELETE for IKE_SA con-mobile²⁹⁰³
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 11[IKE] <con-mobile|2890> sending DELETE for IKE_SA con-mobile²⁸⁹⁰
Jun 15 10:02:15 vpn4 charon⁷¹⁰¹¹: 13[IKE] <con-mobile|2875> sending DELETE for IKE_SA con-mobile²⁸⁷⁵
Jun 15 10:02:16 vpn4 charon⁷¹⁰¹¹: 06[IKE] <con-mobile|2874> sending DELETE for IKE_SA con-mobile²⁸⁷⁴
Jun 15 10:02:16 vpn4 charon⁷¹⁰¹¹: 06[IKE] <con-mobile|2809> sending DELETE for IKE_SA con-mobile²⁸⁰⁹