"
**Title: OPNsense 26.7.7 – Intermittent mpd5 L2TP sequencing failure (FreeBSD ng_l2tp)**
I'm investigating an intermittent L2TP client issue with OPNsense 26.7.7 (amd64), using mpd5 to connect to a Cisco LNS.
The L2TP tunnel establishes successfully, CHAP authenticates, and IPv6CP completes. However, some sessions fail to pass IPv6 traffic, including DHCPv6-PD.
**Findings**
Using the same default OPNsense-generated mpd5 configuration, I've captured both working and failing sessions.
Working session:
- `enable_dseq=0`
- IPv6 ping succeeds (5/5, ~19.5 ms)
- No receive data drops reported
Failing session:
- `enable_dseq=1`
- IPv6 ping fails (0/10)
- `recvDataDrops` increases during testing
- Failure reproduced after a clean reboot
**Packet capture findings**
In the failing session:
- Packets 21–27: Normal SCCRQ/SCCRP/SCCCN and ICRQ/ICRP/ICCN negotiation.
- Packet 28: mpd5 initially sends an LCP packet with `S=1, Ns=0`.
- Subsequent Cisco LCP packets use increasing sequence numbers.
- IPv6 Echo Replies (packets 108, 110, 112, 114, 116) arrive with `S=1, Ns=0`.
- These replies reach the physical interface but are dropped by FreeBSD netgraph.
No Sequencing Required AVP was identified in the decoded session establishment.
**Confirmed workaround**
Disabling data sequencing directly on the active netgraph session immediately restores IPv6 connectivity:
```
ngctl msg '[NODE_ID]:' setsessconfig '{ session_id=0xXXXX peer_id=0xYYYY control_dseq=1 enable_dseq=0 include_length=0 }'
```
This workaround is lost after reconnecting or rebooting.
The generated `/var/etc/mpd_opt5.conf` contains no explicit `dataseq` configuration, and I cannot find an OPNsense GUI option for `set l2tp disable dataseq`.
**Questions**
1. Does anyone know why mpd5 sometimes establishes sessions with `enable_dseq=1` and other times with `enable_dseq=0`, using identical configurations?
2. Is there a supported way to persist `set l2tp disable dataseq` through OPNsense's configuration system?
3. Could mpd5's initial sequenced LCP packet influence the LNS behavior even without a Sequencing Required AVP?
4. Would an OPNsense configuration option to disable L2TP data sequencing be appropriate?
I have full PCAPs of both the working and failing session establishments and can provide sanitized captures.
The LNS operator is also investigating the inconsistent sequence numbers on the Cisco side.
I'm investigating an intermittent L2TP client issue with OPNsense 26.7.7 (amd64), using mpd5 to connect to a Cisco LNS.
The L2TP tunnel establishes successfully, CHAP authenticates, and IPv6CP completes. However, some sessions fail to pass IPv6 traffic, including DHCPv6-PD.
**Findings**
Using the same default OPNsense-generated mpd5 configuration, I've captured both working and failing sessions.
Working session:
- `enable_dseq=0`
- IPv6 ping succeeds (5/5, ~19.5 ms)
- No receive data drops reported
Failing session:
- `enable_dseq=1`
- IPv6 ping fails (0/10)
- `recvDataDrops` increases during testing
- Failure reproduced after a clean reboot
**Packet capture findings**
In the failing session:
- Packets 21–27: Normal SCCRQ/SCCRP/SCCCN and ICRQ/ICRP/ICCN negotiation.
- Packet 28: mpd5 initially sends an LCP packet with `S=1, Ns=0`.
- Subsequent Cisco LCP packets use increasing sequence numbers.
- IPv6 Echo Replies (packets 108, 110, 112, 114, 116) arrive with `S=1, Ns=0`.
- These replies reach the physical interface but are dropped by FreeBSD netgraph.
No Sequencing Required AVP was identified in the decoded session establishment.
**Confirmed workaround**
Disabling data sequencing directly on the active netgraph session immediately restores IPv6 connectivity:
```
ngctl msg '[NODE_ID]:' setsessconfig '{ session_id=0xXXXX peer_id=0xYYYY control_dseq=1 enable_dseq=0 include_length=0 }'
```
This workaround is lost after reconnecting or rebooting.
The generated `/var/etc/mpd_opt5.conf` contains no explicit `dataseq` configuration, and I cannot find an OPNsense GUI option for `set l2tp disable dataseq`.
**Questions**
1. Does anyone know why mpd5 sometimes establishes sessions with `enable_dseq=1` and other times with `enable_dseq=0`, using identical configurations?
2. Is there a supported way to persist `set l2tp disable dataseq` through OPNsense's configuration system?
3. Could mpd5's initial sequenced LCP packet influence the LNS behavior even without a Sequencing Required AVP?
4. Would an OPNsense configuration option to disable L2TP data sequencing be appropriate?
I have full PCAPs of both the working and failing session establishments and can provide sanitized captures.
The LNS operator is also investigating the inconsistent sequence numbers on the Cisco side.
