From 1b2808f1f8cd7d45befa4209c677ebe56d294432 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Fri, 19 Nov 2004 23:05:52 +0000
Subject: [PATCH] bug fix: Honour newer sa setting

---
 etc/inc/vpn.inc | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index bf26aaef72..213aeeb924 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -51,8 +51,9 @@ function vpn_ipsec_configure($ipchg = false) {
 	global $config, $g;
 
 	if(isset($config['ipsec']['preferredoldsa'])) {
-		// Set sysctl -w net.key.preferred_oldsa=0
-		mwexec("sysctl -w net.key.preferred_oldsa=0");
+		mwexec("/sbin/sysctl net.key.preferred_oldsa=0");
+	} else {
+		mwexec("/sbin/sysctl -w net.key.preferred_oldsa=-30");
 	}
 
 	$number_of_gifs = find_last_gif_device();
@@ -89,9 +90,6 @@ function vpn_ipsec_configure($ipchg = false) {
 	mwexec("/usr/sbin/setkey -FP");
 	mwexec("/usr/sbin/setkey -F");
 
-	/* prefer old SAs only for 30 seconds, then use the new one */
-	mwexec("/sbin/sysctl -w net.key.preferred_oldsa=-30");
-
 	if (isset($ipseccfg['enable'])) {
 
 		if (!$curwanip) {