Messages

I have a boot partition of 172K on a new Deciso hardware purchased in December 2025 and delivered with OPNsense 25.10. I'm runnning OPNsense on eight Deciso hardware devices. Just one I reinstalled in the past has 512K. All others have 172K and one has 156K.

These are the steps I am taking to solve my problem remotely. Be careful and do not copy'n'paste. Check your device, partition ids and partition starts and sizes. I did not recreated the EFI partition, because EFI boot is not used on my hardware devices.

Code Select Expand

# gpart show | egrep "GPT|freebsd-boot|efi"
=>        3  500118181  nda0  GPT  (238G)
          3    532480    1  efi  (260M)
    532483        311    2  freebsd-boot  (156K)

# sysctl -a | grep machdep.bootmethod
machdep.bootmethod: BIOS

# umount /boot/efi

# gpart delete -i 1 nda0
nda0p1 deleted

# gpart delete -i 2 nda0
nda0p2 deleted

# ll -h /boot/gptzfsboot
-r--r--r--  1 root wheel  172K Feb  3 14:05 /boot/gptzfsboot

# gpart add -t freebsd-boot -s 512k -b 3 -l gptboot0 nda0
nda0p1 added

# gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 1 nda0
partcode written to nda0p1
bootcode written to nda0

[Reboot]


Thanks a lot for integrating Wazuh agent as an OPNsense plugin at version 23.7.2. I am using Wazuh as SIEM and installed wazuh-agent via CLI, configured Syslog-ng to produce the old standard log format and it works perfectly. Due to this plugin it will be easier to use Wazuh agent on new installed OPNsense firewalls. This saves time. Keep up your good work.

I found a solution. After lifetime of 1 hour ended the Sonicwall sent "DELETE for IKE_SA". OPNsense responded correctly. Setting "Close Action" to "Restart" on OPNsense the connection was "stable". While restarting some packages are dropped, but generally the connection was nearly "stable". Related to the logs I guess Strongswan is using lifetimes of 4 hours instead of 1 hour set in OPNsense GUI. But I cannot prove my suspicion.

Nevertheless I decided on both sides to change from IKEv1 (historical reasons) to IKEv2 with modern ciphers, PFS (DH group), hashes and a lifetime of 4 hours. Until now it seems to be a stable ipsec connection.

After upgrading OPNsense to 23.1 one of four IPsec connections fails after exact one hour. IPsec connections to Cisco routers are stable, only the one IPsec connection to a Sonicwall firewall is unstable.

After one hour I see the following in the Logfiles:

Code Select Expand

charon 38786 - [meta sequenceId="8237"] 01[IKE] <con1|29> received DELETE for IKE_SA con1[29]
charon 38786 - [meta sequenceId="8238"] 01[IKE] <con1|29> deleting IKE_SA con1[29] between 1.2.3.4[opnsense.example.org]...4.3.2.1[sonicwall.example.org]

The connection is gone after that message and did not come back with oder without DPD settings. Manually restarting this connection is successful and then after one hour the connection is gone again.

Nearly one hour after a connection has gone, I see the following messages:

Code Select Expand

charon 38786 - [meta sequenceId="8724"] 01[CFG] <30> selected peer config "con1"
charon 38786 - [meta sequenceId="8725"] 01[IKE] <con1|30> IKE_SA con1[30] established between 1.2.3.4[opnsense.example.org]...4.3.2.1[sonicwall.example.org]
[...]
charon 38786 - [meta sequenceId="8746"] 01[ENC] <con1|30> invalid HASH_V1 payload length, decryption failed?
charon 38786 - [meta sequenceId="8747"] 01[ENC] <con1|30> could not decrypt payloads
charon 38786 - [meta sequenceId="8748"] 01[IKE] <con1|30> message parsing failed

But the connection is not established anymore and works after a manually restart immediately.

We compared all lifetime settings. PSK is not changed. This IPsec connection worked for a long time on OPNsense 22.1 and 22.7 without any problems. Problems started with upgrading to OPNsense 23.1.

What has changed in IPsec on OPNsense 23.1 significantly?

Thanks a lot for any suggestions.