Netgate SG-1000 microFirewall

Author Topic: Dulicate SAs with different IDs  (Read 116 times)

0 Members and 1 Guest are viewing this topic.

Offline netcore

  • Newbie
  • *
  • Posts: 10
  • Karma: +0/-0
    • View Profile
Dulicate SAs with different IDs
« on: December 13, 2017, 04:18:26 am »

I'm experiencing problems with pfsense connecting to a Fortigate VPN Gateway.

We're running a connection using IKE1 using 2 SAs. I've notices that - after some time - multiple entries of the same SA with the same subnet but different local and remote key ids appear
in the IPSEC status of my pfsense 2.4.2. Right now I've deactivated dead peer detection for it's corresponding Phase 1, hoping this will solve the issue.

Could this result from borth partners initiating a connection on the same subnet but with different IDs, thus causing routing problems in my pfsense appliance after some time?
Or could this also be caused by equality of rekeying time in Phase 1 and 2 being 3600 seconds?

- Julian
« Last Edit: December 13, 2017, 04:35:05 am by netcore »