OPNsense 26.7.7 – Intermittent mpd5 L2TP sequencing failure (FreeBSD ng_l2tp)

[Alan]

**Title: OPNsense 26.7.7 – Intermittent mpd5 L2TP sequencing failure (FreeBSD ng_l2tp)**

I'm investigating an intermittent L2TP client issue with OPNsense 26.7.7 (amd64), using mpd5 to connect to a Cisco LNS.

The L2TP tunnel establishes successfully, CHAP authenticates, and IPv6CP completes. However, some sessions fail to pass IPv6 traffic, including DHCPv6-PD.

**Findings**

Using the same default OPNsense-generated mpd5 configuration, I've captured both working and failing sessions.

Working session:
- `enable_dseq=0`
- IPv6 ping succeeds (5/5, ~19.5 ms)
- No receive data drops reported

Failing session:
- `enable_dseq=1`
- IPv6 ping fails (0/10)
- `recvDataDrops` increases during testing
- Failure reproduced after a clean reboot

**Packet capture findings**

In the failing session:

- Packets 21–27: Normal SCCRQ/SCCRP/SCCCN and ICRQ/ICRP/ICCN negotiation.
- Packet 28: mpd5 initially sends an LCP packet with `S=1, Ns=0`.
- Subsequent Cisco LCP packets use increasing sequence numbers.
- IPv6 Echo Replies (packets 108, 110, 112, 114, 116) arrive with `S=1, Ns=0`.
- These replies reach the physical interface but are dropped by FreeBSD netgraph.

No Sequencing Required AVP was identified in the decoded session establishment.

**Confirmed workaround**

Disabling data sequencing directly on the active netgraph session immediately restores IPv6 connectivity:

```
ngctl msg '[NODE_ID]:' setsessconfig '{ session_id=0xXXXX peer_id=0xYYYY control_dseq=1 enable_dseq=0 include_length=0 }'
```

This workaround is lost after reconnecting or rebooting.

The generated `/var/etc/mpd_opt5.conf` contains no explicit `dataseq` configuration, and I cannot find an OPNsense GUI option for `set l2tp disable dataseq`.

**Questions**

1. Does anyone know why mpd5 sometimes establishes sessions with `enable_dseq=1` and other times with `enable_dseq=0`, using identical configurations?
2. Is there a supported way to persist `set l2tp disable dataseq` through OPNsense's configuration system?
3. Could mpd5's initial sequenced LCP packet influence the LNS behavior even without a Sequencing Required AVP?
4. Would an OPNsense configuration option to disable L2TP data sequencing be appropriate?

I have full PCAPs of both the working and failing session establishments and can provide sanitized captures.

The LNS operator is also investigating the inconsistent sequence numbers on the Cisco side.

[franco]

Hi Alan,

It's possible to support the setting for consistency. However, we were discussing pulling PPTP and L2TP support for 27.1 to prepare for the MVC/API migration.

We'll have to discuss internally if L2TP can stay. Ideally, I'd like to hear from other people who still use it.


Cheers,
Franco

[bearr]

AFAIK, mpd5 has a different behaviour than pppd. It by default send pkts numbered. IOS XE has a quirky behaviour when receiving those pkts - it half-sequence its data: for IOSd originated data, they are sequenced; for fast path data, they are not numbered.
The workaround here is to "set l2tp disable dataseq", matching pppd's behaviour.