Network connections are displayed multiple times in IPSec 26.1.9.

[Lochkartenknipser]

Hi,

After updating from 26.1.8 to 26.1.9, 5 Phase 2 connections are displayed for a single IPSec connection.

You cannot view this attachment.

Settings from Phase 2:

You cannot view this attachment.

The same applies to the SA database.
The SP database is normal, with one relationship for each source and destination.

In version 26.1.8, the relationships were unique and not listed multiple times.
Has something changed in version 26.1.9?

Markus

[franco]

Hi Markus,

Cedrik may be more helpful with interpreting the output, but I can confidently say that nothing was changed in the IPsec code.


Cheers,
Franco

[Monviech (Cedrik)]

The only thing I know here that it's generally not a problem because the latest installed SA wins.

Duplicate SAs can be normal during rekeying.

Check your logs if you can find the reason why multiple SAs have been created, there should be some evidence.

Trap+Start as start action could be changed to "Start" if you want to be initiator or "None" if the other side should initiate. Finding out who is the best initiator can help with some of these quirks.

[Lochkartenknipser]

Hi,
I took another closer look at the IPsec connection setup. When I have the 5 Phase 2 entries and deactivate and then re-establish the IPsec tunnel via "Connections," all the "Phase 2" and "SA" entries are normal. So there's only one entry, just as it should be.
When I restart the complete OPNsense, I get multiple "Phase 2" and "SA" entries (sometimes 2, sometimes 5 entries). When I look at the log, I find an entry stating that the domain cannot be resolved from the remote host (the local address and remote host are entered via DNS).

Code Select Expand

2026-06-15T11:44:12 Informational charon17[LIB1] resolving 'firewall.xxxxx-xxxxx.de' failed: Address family for hostname not supported(I have replaced the domain with xxxx).

When I look at the connection log in version 26.1.8, the remote host is resolved immediately and the IPsec tunnel is established right away.
In version 26.1.9, the remote host's domain is resolved with an error, and charon still attempts to establish the tunnel but without success. This results in an additional entry in Phase 2. The tunnel is then established correctly when the first data is sent through the tunnel.
Then another "Phase 2" is established.

Markus

[Lochkartenknipser]

Hi,
I installed the update to 26.1.10 and checked the IPsec connection setup again after restarting OPNsense. The issue persists. When establishing the connection, the endpoints cannot be resolved by DNS, and I get 4 Phase 2 entries.

Is anyone else experiencing this problem?

Markus

Code Select Expand

2026-06-16T09:18:11 Informational charon 17[LIB1] resolving 'xxxxx-xxxxx.xxx4.net' failed: Name does not resolve (local address)
2026-06-16T09:18:11 Informational charon 17[LIB1] resolving 'firewall.xxxx.xxxx.de' failed: Name does not resolve (remote address)

[Monviech (Cedrik)]

How are your hostnames resolved in the first place?
What service are you using for the DNS client of the firewall itself?
Does this DNS service depend on any connectivity that might not be there yet during boot? Maybe another tunnel, or a slow WAN?

[Lochkartenknipser]

The xxxxx are, of course, just placeholders. 
The OPNsense is connected as usual to a Vodafone cable connection without a Fritzbox. The external DNS is Vodafone, without a VPN or similar. This configuration is a test environment that had always worked up until version 26.1.8.
Unbound is used for internal DNS. The error first occurred after the update to 26.1.9. Among other things, OPNsense updates are tested in this test environment before they go into production. In production, there are OPNsense devices that establish 50 IPsec tunnels. If each tunnel generates 5 Phase 2 entries, we'll have to buy a 100-inch monitor.
I now suspect that after the update to 26.1.9, the DNS service starts up more slowly than StrongSwan, preventing the IPsec endpoints from being resolved.

Markus