From 7d5add01e48bab8d82d5a5699325fa7b6aeb4e5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ermal=20LU=C3=87I?= <eri@pfsense.org>
Date: Fri, 24 Apr 2015 17:30:35 +0200
Subject: [PATCH] Use a dirty hack to make IKEv1 with multiple phase2 to work
 correctly with one IKE SA for each subnet

---
 etc/inc/vpn.inc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 3e60e1a1b6..c4b86703a0 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -1074,11 +1074,14 @@ EOD;
 			if (!isset($ph1ent['mobile']) && $keyexchange == 'ikev1') {
 				if (!empty($rightsubnet_spec)) {
 					$ipsecfin = '';
+					$keyingtries = 3;
 					foreach ($rightsubnet_spec as $idx => $rsubnet) {
 						$ipsecfin .= "\nconn con{$ph1ent['ikeid']}00{$idx}\n";
 						if (!empty($reqids[$idx]))
 							$ipsecfin .= "\treqid = " . $reqids[$idx] . "\n";
 						$ipsecfin .= $ipsecconnect;
+						$ipsecfin .= "\tkeyingtries = {$keyingtries}\n";
+						$keyingtries++;
 						$ipsecfin .= "\trightsubnet = {$rsubnet}\n";
 						$ipsecfin .= "\tleftsubnet = " . $leftsubnet_spec[$idx] . "\n";
 					}