IPSEC site-to-site P2's not staying connected

Started by Kadence, November 13, 2025, 09:15:55 PM

Previous topic - Next topic
This one has me scratching my head.
I have an OPNSense virtual machine running in my home office that connects to a handful of client sites with a mixed array of devices at the other end.
This isn't really relevant but I have found lately that I'm needing to restart OPNSense about once every 2 weeks when my Internet goes down. It seemed to be a DNS issue. I suspected that the underlying issue might have been my aging ESX server. Rather than migrate my VM I built a new Proxmox server and rolled a fresh VM from scratch to hold OPNSense. That has solved my Internet outage issues.

Since I built the new instance from scratch I figured now was a good time to rebuild my IPSEC tunnels using the new Connections configuration tool.
I've only tackled one so far and got it set up without too much trouble to connect to a clients pfSense instance.

All went perfectly well but I'm finding after a certain amount of time (the duration of which I haven't determined) my Phase 2 will disconnect.
Overview shows that the Phase 1 is still connected. Disconnecting and reconnecting the Phase 1 will re-establish the Phase 2 without any issues it just drops later on.

In reading through the forums I see that setting the REQID is a potential fix. This particular connection had 3x Phase 2's in it and I extracted the REQID from the pfSense end to put into OPNSense but that didn't change much for me with preventing the Phase2 from dropping.
So far I have Set Start action to Start and DPD to Trap as well as tried setting Start to Start+Trap. Nothing has changed the outcome for me.

While this is technically a separate issue, having multiple Phase2's appears to be a minor issue. If I set separate Phase2's for each LAN I want to connect to then OPNSense will only connect the first one in the list.
If I put all of the subnets that I want to connect to into one Phase2 then all of them will connect and work fine, until the Phase2 disconnects.
The pfSense instance that I'm connecting to has separate REQID's for each Phase2 so if REQID happens to be part of the fix to prevent my Phase2 from dropping but OPNSense won't connect them all if there are multiple Phase2's then I need to find a way to establish multiple Phase2's with REQID's and convince OPNSense to connect all of them. 

So far it's not a big deal for me to disconnect/reconnect a Phase1 in order to do what I need to do and just let it connect.
Some of my remote sites are running OPNSense appliances and if I want to switch to configuring them with Connections (or replace some of the pfSense sites with OPNSense) then I'm hoping to find a solution that will prevent the Phase2's from dropping before I go ahead with that. It's not crucial that my tunnels stay active all the time but some of the others have tunnels between them that I'll need to stay active so I'm hoping to solve this puzzle in my network before I push on.

I'd love to hear any thoughts anyone might have as I'm clearly missing something.