Tips on Reliable IPsec Configuration (VTI/Route Based)

[jambandfan_1996]

I'm new to the OPNsense community and recently tested a couple devices running 26.1 in GNS3, before I plan to deploy into our ecosystem later this month. I have the need for a reliable always on type route based IPsec tunnel.

I found the tutorial presented at https://docs.opnsense.org/manual/how-tos/ipsec-s2s-conn-route.html to be easy to follow, although what I was left with initially following the tutorial were tunnels that exhibited some unreliable behavior. Notably tunnels not reconnecting following device restarts, requiring manual intervention, and tunnels that needed traffic initiated from both sides of the tunnel before allowing traffic across.

I'm far from a networking expert, so it took me about a day to get the connections working to my liking. I figured I would share what I learned to save any other newcomers some time.

Tunnels not passing traffic until something is initiated from both sides

Issue: For whatever reason, my tunnels would not send traffic routed to a vti across the ipsec link until a host on both sides of the link initiated a connection. For example, a host at 1 site could sit and ping a host across the tunnel all day and not get a response, until a host on the other side also tried to reach out to a host on the first side.

Resolution: I have no idea why this behavior happens, however I resolved it by making sure gateway monitoring on my vti interfaces is enabled. With the gateway monitoring option enabled on these interfaces, they are constantly pinging each other to check link health. As a result, the tunnels are able to pass traffic as soon as the link is established. I also set "Start action" to "start" and "dpd action" to "start" on the child configuration of the tunnel, but I'm not sure if that had much of an effect.

Links not connecting automatically following device restarts

Issue:Following the restart of one or more firewalls, the phase 1 connection would sometimes fail, and I would have to manually start the connection from the "status overview" page after the firewalls were up for a minute.

Resolution: After some research I found the "keyingtries" option under vpn-ipsec-connections-[connection]-advanced apparently defines how many times the device will try to establish the connection before giving up. I'm not sure what this defaults to but if you set to 0, that basically has it try forever. I also set the "version" option from the default to "IKEv2", but I'm not sure if that had any effect.

Hope someone can find this info useful!