Switching IPsec phase one to vti from Tunnel IPv4 and back yields unexpected behavior
On 2.4.4.a.20180720.1418, create a site-to-site IPsec tunnel, with Tunnel IPv4 selected as the mode for the phase two. After saving and applying changes, confirm the tunnel established correctly.
Add a rule on the IPsec interface to allow any traffic.
Initiate a ping across the tunnel from a host on one side, to the firewall itself or another host on the other side. The ping will succeed.
Change the phase two's mode to vti, save, apply changes, stop and start the service.
The pings will fail. (as expected)
Visit Interfaces > Assignments and see that the ipsec1000 interface is ready to be assigned. Do not assign it.
Go back to the IPsec tunnel and change the phase two mode back to Tunnel IPv4, save, apply changes, stop and start the service.
The pings will continue to fail, despite the phase two mode being changed back to Tunnel IPv4 from vti.
Visit Interfaces > Assignments and see that the ipsec1000 interface is still ready to be assigned. Although it should no longer be available for assignment since the phase two mode is no longer vti.
Go back to the IPsec tunnel and delete it.
Go back to the Interfaces > Assignment page and the ipsec1000 interface is still ready to be assigned.
Recreating the tunnel has no effect, the phase one and phase two will come up, traffic will come in from either side but it will not pass through pfSense.
VTI input validation. Fixes #8674
Add input validation to prevent switching away from VTI or deleting a
VTI P1/P2 which belongs to an assigned interface, since this would break
the interface assignment and cause an interface mismatch at the next
#7 Updated by Jim Pingle over 1 year ago
I just pushed some extra input validation which does the following:
- Prevents from switching VTI to another P2 mode with an assigned interface
- Prevents disabling a VTI P2 with an assigned interface
- Prevents deleting a VTI P2 with an assigned interface
- Prevents deleting a P1 which contains a VTI P2 with an assigned interface
#10 Updated by James Dekker over 1 year ago
On 2.4.4.a.20180724.1715, unable to switch from VTI to another P2 mode with an assigned interface; unable to disable a VTI P2 with an assigned interface; unable to delete a VTI P2 with an assigned interface; unable to delete a P1 which contains a VTI P2 with an assigned interface. Looks good.
#14 Updated by James Dekker over 1 year ago
On 2.4.4.a.20180725.0317 with patches b66b72d0ae725392b0158de3a0ec0731d71cd793 and cc240e3259d90ed236872de5cba346fe092eda85 applied, the user is unable to disable a Phase one with a Phase two configured with VTI and it's VTI interface assigned. The user is also unable to edit the Phase two configured with VTI and it's interface assigned, to check the box to disable.