For IPSec ESP packets, Stateful firewall will show 4 sessions instead of 2 sessions. However, there will be 2 sessions with 0 counters. This article will explain this behavior.
These are IPSec sessions from peers:
Local gateway: 10.0.1.2, Remote gateway: 192.168.0.1 inbound C949 D4B8 0 tunnel dynamic ESP outbound F4B8 82AD 0 tunnel dynamic ESP Local gateway: 192.168.0.1, Remote gateway: 10.0.1.2 inbound F4B8 82AD 0 tunnel dynamic ESP outbound C949 D4B8 0 tunnel dynamic ESP
This is what the Stateful firewall shows for this IPsec session between the peers:
ESP 192.168.0.1:51529 -> 10.0.1.2:54456 Forward O 1197 ESP 10.0.1.2:54456 -> 192.168.0.1:51529 Forward I 0 ESP 10.0.1.2:62648 -> 192.168.0.1:33453 Forward I 1197 ESP 192.168.0.1:33453 -> 10.0.1.2:62648 Forward O 0
Since ESP packet does not have a port like TCP or UDP, we assigned the outbound SPI’s last 2 bytes for ESP in the SFW output as a port number. Port numbers were changed to HEX for better understanding the output.
Since the outbound SPI is different on each side, it will create two sessions. The return traffic will not match the forward traffic due to difference in SPI.
This session is created by traffic originated from the 192.168.0.1 with SPI C949D4B8:
ESP 192.168.0.1:C949 -> 10.0.1.2:D4B8 Forward O 1197 ESP 10.0.1.2:D4B8 -> 192.168.0.1:C949 Forward I 0
This session is created by traffic originated from 10.0.1.2 with SPI F4B882AD:
ESP 10.0.1.2:F4B8 -> 192.168.0.1:82AD Forward I 1197 ESP 192.168.0.1:82AD -> 10.0.1.2:F4B8 Forward O 0