IPSEC Multiple SPIs State Installed?

[henningkessler]

Hello,

I am connecting two OPNsenses via IPSEC successfully but it seams to strange/flakey as connections between both sides drops quite fast even with DPD configured on both sides. At the same time In the "Status Overview"  I have several SPIs with a INSTALLED/routed status.

Side A is a single OPNsense connecting via PPPoE with an dynamically allocated IPv4 address and a DynDNS hostname.
Side B are two OPNsense in HA with a public /29 IPv4 net.

here are my configs

A<>B
Connection method      default<>default
Key Exchange version    auto<>auto
Internet Protocal       IPv4<>IPv4
Interface             WAN<>"CARP IP"
Remote Gateway          "CARP IP"<>"DYNDNS-FQDN"
Dynamic Gateway       No<>YES

Phase 1 proposal (Authentication)
Authentication method    Mutal PSK<>Mutual PSK
My Identifier          DN "DYNDNS-FQDN"<>IPAdress "CARP IP"
Peer Identifier       IPAdress "CARP IP"<>DN "DYNDNS-FQDN"

Phase 1 proposal (Algorithms)
Encryption algorithm    AES 256<>AES 256
Hash Algorithms       SHA256<>SHA256
DH key group         14<>14
Lifetime             28800<>28800
NAT Traversal          Enable<>Enable
Dead Peer Detection    YES<>YES

Tunnel
Mode                Tunnel IPv4<>Tunnel IPv4
LocalNetwork
Type               Network<>Network
Address             172.19.173.0/24<>10.100.0.0/16
Remote Network
Type                 Network<>Network
Address               10.100.0.0/16<>172.19.173.0/24
Phase 2 Proposal
Protocol            ESP<>ESP
Encryption             AES 256bits auto<>AES 256bits auto
Hash algorithms       SHA256<>SHA256
PFS key group          14<>14
Lifetime             3600<>3600
Advanced Options
Automatically ping host "LAN CARP IP"<>"OPN LAN IP"

[mfedv]

Hi,

lots of possible reasons, probably ipsec logs and perhaps packet filter logs required for further analysis.

On the HA opnsense side, please check if your fw rules allow incoming IKE/ESP traffic from everywhere (or some subnets, if you know the dynamic ip address comes from a certain pool). Fw rules for IKE/ESP are not auto-generated if you use a CARP address. It might still work sometimes, if the HA opnsense initiates the connection and the "let out anything" rule kicks in.

DPD keeps up the IKE connection, and with non-UDP-encapsulated ESP you may need traffic inside the tunnel to keep up connection state in the packet filters. Auto-Ping is perhaps not enough, it sends 3 packets every 4 minutes. If no other traffic is sent, 4 minutes may be too long to keep connection state for ESP up. This should not be a problem if your fw rules allow ESP traffic even without existing connection state as explained above.

[henningkessler]

Hi mfedv,

sorry for the late reply. As you suggest I added two fw rules to my WAN interface and it actually solved almost all my problems.

I am still getting multiple ESP? tunnels and the tunnels seam to be closed quite fast but they are opened much quicker then before..

Thanks for helping

Henning