From c2a7d1a913db566724f9d2cb835f86e451c63cd3 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Thu, 31 Jul 2025 22:35:58 +0200
Subject: [PATCH] VPN: IPsec - fix regression in
 https://github.com/opnsense/core/commit/b440c12e80b86, all indexed fields are
 flushed into the config, these virtual ones shouldn't go there. closes
 https://github.com/opnsense/core/issues/9022

---
 src/opnsense/mvc/app/models/OPNsense/IPsec/Swanctl.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/opnsense/mvc/app/models/OPNsense/IPsec/Swanctl.php b/src/opnsense/mvc/app/models/OPNsense/IPsec/Swanctl.php
index e91fb5faa7..42f0859aa4 100644
--- a/src/opnsense/mvc/app/models/OPNsense/IPsec/Swanctl.php
+++ b/src/opnsense/mvc/app/models/OPNsense/IPsec/Swanctl.php
@@ -191,7 +191,10 @@ class Swanctl extends BaseModel
                 $parent = null;
                 $thisnode = [];
                 foreach ($node->iterateItems() as $attr_name => $attr) {
-                    if ($attr_name == 'connection' && isset($data['connections'][(string)$attr])) {
+                    if ($key == 'connections' && in_array($attr_name ,['local_ts', 'remote_ts'])) {
+                        /* virtual nodes belonging to child */
+                        continue;
+                    } elseif ($attr_name == 'connection' && isset($data['connections'][(string)$attr])) {
                         $parent = (string)$attr;
                         continue;
                     } elseif ($attr_name == 'pools') {