OPNsense Forum

English Forums => High availability => Topic started by: ying18 on February 07, 2021, 02:09:46 pm

Title: IPSec Site to Site Tunnel with HA
Post by: ying18 on February 07, 2021, 02:09:46 pm

I have 2 OPNSense appliances configured and running in HA mode. CARP / HA Failover / pfSync seem to be working fine, except for one thing. We have an IPSec tunnel to a remote site that needs to be re-established when the failover occurs. In our case, the IPSec tunnel does not re-establish (yes, IPSec is selected to sync and it appears to be working).

What I would expect is that the MASTER would connect to the tunnel and upon failover, the BACKUP would connect to the tunnel. But, what I see is that both the MASTER and the BACKUP are attempting to connect at the same time.

Are there any documents or sample configurations for this? I can't seem to find any and would like some assistance with this.
Siot(สล๊อตออนไลน์) (https://electroambientspace.com/entrance-slot-online/)

Title: Re: IPSec Site to Site Tunnel with HA
Post by: pmladenov on February 23, 2021, 08:52:50 pm

Hi ying18,

I saw similar behavior - although I've selected in Phase 1 the CARP logical interface, during failovers I can see both FWs are trying to use the physical IP address initially...
Also keep in mind that Dead Pear Detection is taking almost 3 minutes to detect a failure (despite what you've configured).
Probably the better approach here is to have 2 separate tunnels to both Firewalls in the HA setup and not to rely on any timers. 

Title: Re: IPSec Site to Site Tunnel with HA
Post by: mimugmail on February 24, 2021, 06:33:13 am

You have to select the VIP in the interface section of Phase1 and also be sure to tick "Disable MOBIKE" checkbox

Title: Re: IPSec Site to Site Tunnel with HA
Post by: mnaim on February 24, 2021, 05:29:13 pm

I have same problem, Interface - selected VIP, ticked Disable MOBIKE, still no connect.
On status page if I disconnect and reconnect tunnel, it connects sucessfully.

Title: Re: IPSec Site to Site Tunnel with HA
Post by: mimugmail on February 24, 2021, 05:35:43 pm

Any logs?

Title: Re: IPSec Site to Site Tunnel with HA
Post by: nzkiwi68 on April 28, 2021, 04:25:42 am

There is a bug that is fixed in 21.7 due out in July 2021 whereby the auto WAN allow IPSEC firewall rules are not created for IPSEC P1 tunnels which bind to a CARP address.

Write some manual WAN allow IPSEC rules or manually apply the patch.

Missing auto generated WAN firewall rules for permit IPsec when IPsec P1 using CARP address
https://github.com/opnsense/core/issues/4920 (https://github.com/opnsense/core/issues/4920)

To manually apply this patch:
SSH to your firewall, run a command prompt and run:
opnsense-patch 45b697f

Title: Re: IPSec Site to Site Tunnel with HA
Post by: iislas18 on August 23, 2021, 04:53:56 pm

I updated to 21.1.7 and ran that patch, before I had 43 auto generated rules, I have about 6 IPsec tunnels and after applying the patch I only have 1 auto generated rule.