**Title: OPNsense 26.7.7 – Intermittent mpd5 L2TP sequencing failure (FreeBSD ng_l2tp)**
I'm investigating an intermittent L2TP client issue with OPNsense 26.7.7 (amd64), using mpd5 to connect to a Cisco LNS.
The L2TP tunnel establishes successfully, CHAP authenticates, and IPv6CP completes. However, some sessions fail to pass IPv6 traffic, including DHCPv6-PD.
**Findings**
Using the same default OPNsense-generated mpd5 configuration, I've captured both working and failing sessions.
Working session:
- `enable_dseq=0`
- IPv6 ping succeeds (5/5, ~19.5 ms)
- No receive data drops reported
Failing session:
- `enable_dseq=1`
- IPv6 ping fails (0/10)
- `recvDataDrops` increases during testing
- Failure reproduced after a clean reboot
**Packet capture findings**
In the failing session:
- Packets 21–27: Normal SCCRQ/SCCRP/SCCCN and ICRQ/ICRP/ICCN negotiation.
- Packet 28: mpd5 initially sends an LCP packet with `S=1, Ns=0`.
- Subsequent Cisco LCP packets use increasing sequence numbers.
- IPv6 Echo Replies (packets 108, 110, 112, 114, 116) arrive with `S=1, Ns=0`.
- These replies reach the physical interface but are dropped by FreeBSD netgraph.
No Sequencing Required AVP was identified in the decoded session establishment.
**Confirmed workaround**
Disabling data sequencing directly on the active netgraph session immediately restores IPv6 connectivity:
```
ngctl msg '[NODE_ID]:' setsessconfig '{ session_id=0xXXXX peer_id=0xYYYY control_dseq=1 enable_dseq=0 include_length=0 }'
```
This workaround is lost after reconnecting or rebooting.
The generated `/var/etc/mpd_opt5.conf` contains no explicit `dataseq` configuration, and I cannot find an OPNsense GUI option for `set l2tp disable dataseq`.
**Questions**
1. Does anyone know why mpd5 sometimes establishes sessions with `enable_dseq=1` and other times with `enable_dseq=0`, using identical configurations?
2. Is there a supported way to persist `set l2tp disable dataseq` through OPNsense's configuration system?
3. Could mpd5's initial sequenced LCP packet influence the LNS behavior even without a Sequencing Required AVP?
4. Would an OPNsense configuration option to disable L2TP data sequencing be appropriate?
I have full PCAPs of both the working and failing session establishments and can provide sanitized captures.
The LNS operator is also investigating the inconsistent sequence numbers on the Cisco side.