Project

General

Profile

Actions

Bug #4704

closed

IKEv2 to Cisco ASA won't bring up multiple P2 networks

Added by Roman H almost 9 years ago. Updated about 8 years ago.

Status:
Resolved
Priority:
High
Category:
IPsec
Target version:
Start date:
05/14/2015
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2.x
Affected Architecture:

Description

Setup is following:

pFsense firewall - have subnet 192.168.23.0/24 subnet, where host itself have 192.168.23.55

Have 1 ikev2 p1. tunnel itself works absolutely fine - as seen in logs.
Have 3 p2 over ikev2 tunnel - 10.8.67.0/24, 10.14.67.0/24, 10.9.73.0/24. All of them part of con4 in ipsec.conf and appear at GUI

conn con4
fragmentation = yes
keyexchange = ikev2
reauth = yes
forceencaps = no
mobike = no
rekey = yes
installpolicy = yes
type = tunnel
dpdaction = none
auto = route
left = 62.x.x.x
right = 38.y.y.y
leftid = 62.x.x.x
ikelifetime = 86400s
lifetime = 28800s
ike = aes192-sha1-modp1536!
esp = aes192-sha1,aes192-sha1,aes192-sha1!
leftauth = psk
rightauth = psk
rightid = 38.y.y.y
rightsubnet = 10.8.67.0/24,10.14.67.0/24,10.9.73.0/24
leftsubnet = 192.168.23.0/24

So - in this configuration - when I initiate a tunnel from my side - it brings up ONLY last subnet in row with "rightsubnet" - 10.9.73.0/24

If I edit this file, or move subnet within gui - it will bring up different last subnet to live.
If I trying to manually bring all networks via command line - ipsec up con4 - it still brings only LAST one to live.

If I ping any address (10.8.67.2 or 10.14.67.2 ) within subnets, that are not up - pFsense won't bring them up.
If I ping pFsense (192.168.23.55) from 10.8.67.0/24 or from 10.14.67.0/24 hosts - it will bring up those subnets UP.

Other side - cisco asa 5515 (i'm unclear with its firmware version, but I able to retrieve it in case of need).

Bug reproducible both on 2.2.2 and 2.2.3 dev from 10 May.


Files

0001.PNG (38.4 KB) 0001.PNG Roman H, 05/14/2015 04:01 AM
0002.PNG (21.9 KB) 0002.PNG Roman H, 05/14/2015 04:01 AM
Actions

Also available in: Atom PDF