I having an issue with IPsec policy routing. If I have two policy tunnels configured for 1 peer, the second tunnel is ignored and never initialized. I also have the issue that the first tunnel will not renew. I basically copied a working configuration from edgeos which has a common ancestor to vyos so I don’t think it is the configuration. If I delete the 1st tunnel than the 2nd tunnel is brought up. I use a couple of source nat rules to trigger each tunnel so I’m able to test each tunnel individually. I found the following thread that is a couple years old that looks like the same problem which was fixed for vyos 1.3 and 1.4. Since I’m using the latest rolling release and its now 2-3 years later I decided to make a new thread.
sam@cr:~$ show system image
Name Default boot Running
------------------------ -------------- ---------
2025.03.09-0613-rolling Yes Yes
1.5-rolling-202502190007
sam@cr# show nat source
rule 10 {
description IPSEC1
destination {
address <NET1>
}
outbound-interface {
group WAN
}
protocol all
translation {
address 172.16.20.3
}
}
rule 20 {
description IPSEC2
destination {
address <NET2>
}
outbound-interface {
group WAN
}
protocol all
translation {
address 172.16.20.3
}
}
rule 100 {
outbound-interface {
group WAN
}
translation {
address masquerade
}
}
sam@cr# show vpn
ipsec {
authentication {
psk peer1 {
id <WANIP>
secret XXXX
}
}
esp-group FOO1 {
lifetime 28800
mode tunnel
pfs dh-group14
proposal 1 {
encryption aes256
hash sha256
}
}
ike-group FOO1 {
key-exchange ikev2
lifetime 28800
proposal 1 {
dh-group 14
encryption aes256
hash sha256
}
}
site-to-site {
peer peer1 {
authentication {
local-id <WANIP)
mode pre-shared-secret
}
connection-type initiate
ike-group FOO1
ikev2-reauth inherit
local-address <WANIP>
remote-address <PEER1 IP>
tunnel 1 {
esp-group FOO1
local {
prefix 172.16.20.0/28
}
remote {
prefix <NET1>
}
}
tunnel 2 {
esp-group FOO1
local {
prefix 172.16.20.0/28
}
remote {
prefix <NET2>
}
}
}
}
}
T7257 Multiple IPSEC SA not initiating/IPSec SA not renewing