IPsec VPN change from ISP and it does not work correctly

[rraragon]

I have the problem between a VPN tunnel between two FortiGate a 500E and a 60E.

The VPN tunnel existed between the two computers and it was functional, but in the FW FG60E the ISP provider was changed, the new ISP was placed in the WAN2 of the equipment, the old tunnel used WAN1 (the link was already deleted).

After the link provider change, the IPsec VPN tunnel is established, but the communication inside the tunnel no longer works.

The data of the 500E firewall comes out, the 60E firewall receives it, I see the answer coming out of the 60E, but the 500E firewall no longer receives any packet.

Please help me to solve this issue, thanks!

[Toshi_Esumi]

I heard similar problems before. First think I would try is rebooting the unit, which would clear all existing sessions. Or if you can't/don't want to reboot, and are familiar with "sessions", you can try clear all sessions related to the tunnel.

If still no traffic flow through the tunnel, I would remove the tunnel config including all dependencies (this means  removing the policies as well). Then recreate it with a new name with wan2.

[rraragon]

Thanks for your response, but this is a first I do, and don't work.

Delete and create the tunnel and dont work.

A few minutes ago, I try create the same VPN with others FortiGate, and not work, I think is issue from FG60E.

Any other idea?

Thanks for your comments.

Regards.

[Toshi_Esumi]

Do you actually see the tunnel up in CLI like below?

xxx-fg1 # get vpn ipsec tun sum 'TUN1' xxx.xxx.xxx.xxx:4500  selectors(total,up:( 1/1  rx(pkt,err): 130561/0  tx(pkt,err): 266333/0

Then try ping the other end of interface IP from one end:

sea5601-fg1 # sh sys int TUN1 config system interface     edit "TUN1"         set vdom "root"         set ip 10.xxx.xxx.130 255.255.255.255         set allowaccess ping https ssh snmp         set type tunnel         set remote-ip 10.xxx.xxx.129 255.255.255.255         set snmp-index 17         set interface "OUTGOING_INT"     next end sea5601-fg1 # execute ping 10.xxx.xxx.129 PING 10.xxx.xxx.129 (10.xxx.xxx.129): 56 data bytes 64 bytes from 10.xxx.xxx.129: icmp_seq=0 ttl=255 time=37.8 ms 64 bytes from 10.xxx.xxx.129: icmp_seq=1 ttl=255 time=38.1 ms 64 bytes from 10.xxx.xxx.129: icmp_seq=2 ttl=255 time=40.1 ms 64 bytes from 10.xxx.xxx.129: icmp_seq=3 ttl=255 time=39.9 ms 64 bytes from 10.xxx.xxx.129: icmp_seq=4 ttl=255 time=38.2 ms --- 10.xxx.xxx.129 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 37.8/38.8/40.1 ms If you can't ping, something is wrong with the tunnel itself. If you can ping like above but user traffic doesn't flow the problem is either a phase2 selector issue or a routing issue.

[sw2090]

I have similar issues with some 90D and 100D and 100E. I didn't change the ISP but changed the way it is connected to ISP. Before it used to connect with PPPOE in bridge mode and VPN worked fine. Now we connect throuogh a LANCOM Router without bridge mode but with Portforward on the Lancom for 500/4500 UDP (NAT-T and IPSEC). WAN IPs have been transferred the new connection and are still the same now (and still static) Now VPN repeatedly stops working with the very same symptoms. FGT shows tunnel is up in gui but bo traffic going through. Shutting down the tunnel forcedly via gui and letzt it build up again thereafter makes it work nrmally again for a while. 

Doesn't look to me as if this is a FGT60 related poblem...

[rraragon]

Thanks for your comments, I still verify what happens, and encounter issues with my ISP, they block ports into their equipments.