Hot!IPsec VPN change from ISP and it does not work correctly

Author
rraragon
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/05/24 10:48:28
  • Status: offline
2019/05/24 11:38:49 (permalink)
0

IPsec VPN change from ISP and it does not work correctly

I have the problem between a VPN tunnel between two FortiGate a 500E and a 60E.
 
The VPN tunnel existed between the two computers and it was functional, but in the FW FG60E the ISP provider was changed, the new ISP was placed in the WAN2 of the equipment, the old tunnel used WAN1 (the link was already deleted).
 
After the link provider change, the IPsec VPN tunnel is established, but the communication inside the tunnel no longer works.
 
The data of the 500E firewall comes out, the 60E firewall receives it, I see the answer coming out of the 60E, but the 500E firewall no longer receives any packet.
 
Please help me to solve this issue, thanks!
#1

5 Replies Related Threads

    Toshi Esumi
    Expert Member
    • Total Posts : 1623
    • Scores: 137
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: IPsec VPN change from ISP and it does not work correctly 2019/05/24 13:29:20 (permalink)
    1 (1)
    I heard similar problems before. First think I would try is rebooting the unit, which would clear all existing sessions. Or if you can't/don't want to reboot, and are familiar with "sessions", you can try clear all sessions related to the tunnel.
    If still no traffic flow through the tunnel, I would remove the tunnel config including all dependencies (this means  removing the policies as well). Then recreate it with a new name with wan2.
     
    #2
    rraragon
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/05/24 10:48:28
    • Status: offline
    Re: IPsec VPN change from ISP and it does not work correctly 2019/05/24 13:51:39 (permalink)
    0
    Thanks for your response, but this is a first I do, and don't work.
     
    Delete and create the tunnel and dont work.
     
    A few minutes ago, I try create the same VPN with others FortiGate, and not work, I think is issue from FG60E.
     
    Any other idea?
     
    Thanks for your comments.
     
    Regards.
    #3
    Toshi Esumi
    Expert Member
    • Total Posts : 1623
    • Scores: 137
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: IPsec VPN change from ISP and it does not work correctly 2019/05/24 14:58:07 (permalink)
    0
    Do you actually see the tunnel up in CLI like below?
    xxx-fg1 # get vpn ipsec tun sum
    'TUN1' xxx.xxx.xxx.xxx:4500  selectors(total,up): 1/1  rx(pkt,err): 130561/0  tx(pkt,err): 266333/0
    Then try ping the other end of interface IP from one end:
    sea5601-fg1 # sh sys int TUN1
    config system interface
        edit "TUN1"
            set vdom "root"
            set ip 10.xxx.xxx.130 255.255.255.255
            set allowaccess ping https ssh snmp
            set type tunnel
            set remote-ip 10.xxx.xxx.129 255.255.255.255
            set snmp-index 17
            set interface "OUTGOING_INT"
        next
    end
    sea5601-fg1 # execute ping 10.xxx.xxx.129
    PING 10.xxx.xxx.129 (10.xxx.xxx.129): 56 data bytes
    64 bytes from 10.xxx.xxx.129: icmp_seq=0 ttl=255 time=37.8 ms
    64 bytes from 10.xxx.xxx.129: icmp_seq=1 ttl=255 time=38.1 ms
    64 bytes from 10.xxx.xxx.129: icmp_seq=2 ttl=255 time=40.1 ms
    64 bytes from 10.xxx.xxx.129: icmp_seq=3 ttl=255 time=39.9 ms
    64 bytes from 10.xxx.xxx.129: icmp_seq=4 ttl=255 time=38.2 ms

    --- 10.xxx.xxx.129 ping statistics ---
    5 packets transmitted, 5 packets received, 0% packet loss
    round-trip min/avg/max = 37.8/38.8/40.1 ms

    If you can't ping, something is wrong with the tunnel itself. If you can ping like above but user traffic doesn't flow the problem is either a phase2 selector issue or a routing issue.
    #4
    sw2090
    Gold Member
    • Total Posts : 370
    • Scores: 21
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: IPsec VPN change from ISP and it does not work correctly 2019/05/26 23:48:37 (permalink)
    0
    I have similar issues with some 90D and 100D and 100E. I didn't change the ISP but changed the way it is connected to ISP. Before it used to connect with PPPOE in bridge mode and VPN worked fine. Now we connect throuogh a LANCOM Router without bridge mode but with Portforward on the Lancom for 500/4500 UDP (NAT-T and IPSEC). WAN IPs have been transferred the new connection and are still the same now (and still static) Now VPN repeatedly stops working with the very same symptoms. FGT shows tunnel is up in gui but bo traffic going through. Shutting down the tunnel forcedly via gui and letzt it build up again thereafter makes it work nrmally again for a while. 
    Doesn't look to me as if this is a FGT60 related poblem...
     
    #5
    rraragon
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/05/24 10:48:28
    • Status: offline
    Re: IPsec VPN change from ISP and it does not work correctly 2019/05/27 08:33:52 (permalink)
    0
    Thanks for your comments, I still verify what happens, and encounter issues with my ISP, they block ports into their equipments.
    #6
    Jump to:
    © 2019 APG vNext Commercial Version 5.5