Hot!VPN Tunnel stays up but not traffic passing from our end

Author
Greggor25
New Member
  • Total Posts : 12
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/01 14:14:41
  • Status: offline
2019/07/02 08:12:39 (permalink)
0

VPN Tunnel stays up but not traffic passing from our end

We have site to site VPN from Fortigate to Cisco.  The issue started out with DPD errors with tunnel dropping. We have corrected that issue.  The issue we're experiencing now is the tunnel stays up but we aren't able to send traffic to other end and traffic stops flowing.  I've noticed this happens between a rekey. This happens every eighteen hours. 
 
We've tried playing with settings by turning off DPD and back on.  I increased the lifetime seconds on P2 to 86400 to see if that will alleviate the issue.  We're natting a public IP for interesting traffic to their public subnets in P2 selectors.  I create a IP pool for that IP that allows everything from my internal network.  
 
Is anyone experiencing the same issue? 
#1

13 Replies Related Threads

    Toshi Esumi
    Expert Member
    • Total Posts : 1802
    • Scores: 151
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/02 10:00:53 (permalink)
    0
    If you run IKE debug on the Cisco and FGT at the time the key expired, you should be able to see what failed. 
    But when we were using Cisco/FGT IKEv1 IPsec years ago we had some problem with DPD between them. So we disabled DPD and used IP SLA from the cisco side to keep the tunnel up. After migrated to IKEv2 DPD(INFORMATIONAL exchange) doesn't seem to cause problems so we're enabling it. 
    Also, I would suggest disabling anti-replay feature on both sides to see if it makes any difference in the debugging. 
    #2
    Greggor25
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/01 14:14:41
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/09 08:43:30 (permalink)
    0
    I've mentioned disabling anti-replay but haven't heard anything back. We don't maintain the Cisco on the other end. 
     
    Under P2 selectors I'm using named addresses that I've specified in FGT and remote end is using IP's. Would that make a difference?   
    #3
    rwpatterson
    Expert Member
    • Total Posts : 8419
    • Scores: 197
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/09 09:21:23 (permalink)
    0
    Way back in the past it did. Not sure if it would now. I was on 4.x firmware.

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.19-b0694
    FWF60B
    FWF80CM (4)
    FWF81CM (2)
     
    #4
    brycemd
    Silver Member
    • Total Posts : 75
    • Scores: 4
    • Reward points: 0
    • Joined: 2016/12/03 11:24:30
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/09 09:44:27 (permalink)
    0
    Named selectors vs subnet only matters, in my experience, when there are multiple subnets involved. If one side is combining everything into a single phase two and the other is using multiple phase twos then you are going to run into issues.
    #5
    Greggor25
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/01 14:14:41
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/09 09:51:24 (permalink)
    0
    We are talking about multiple subnets.  
    #6
    brycemd
    Silver Member
    • Total Posts : 75
    • Scores: 4
    • Reward points: 0
    • Joined: 2016/12/03 11:24:30
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/09 09:54:29 (permalink)
    0
    Then it's likely the named selector is combing everything into 1 phase two and the cisco side has a phase 2 per subnet <> subnet.
     
    You'll have to do multiple phase 2's
    #7
    Greggor25
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/01 14:14:41
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/09 09:58:42 (permalink)
    0
    I have multiple Phase 2 selectors setup.  I'm thinking about changing them back IP address. 
     
    Each of them are going to different subnets.  
    post edited by Greggor25 - 2019/07/09 10:26:51

    Attached Image(s)

    #8
    rwpatterson
    Expert Member
    • Total Posts : 8419
    • Scores: 197
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/09 11:20:41 (permalink)
    0
    Worst case, flip one and see if conditions improve.

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.19-b0694
    FWF60B
    FWF80CM (4)
    FWF81CM (2)
     
    #9
    Greggor25
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/01 14:14:41
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/09 12:07:02 (permalink)
    0
    If I make changes like that during production times, will it take the tunnel down?  
    #10
    Greggor25
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/01 14:14:41
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/09 15:20:25 (permalink)
    0
    I made the changes to Phase 2 selectors to be IP addresses.  I'll wait to see if the tunnel drops. 
    #11
    Greggor25
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/01 14:14:41
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/10 08:38:37 (permalink)
    0
    It dropped again.  I'm at a loss at everything I've tried. 
    #12
    rwpatterson
    Expert Member
    • Total Posts : 8419
    • Scores: 197
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/10 08:44:30 (permalink)
    0
    Find out from the remote end what their lifetime settings are and match them.

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.19-b0694
    FWF60B
    FWF80CM (4)
    FWF81CM (2)
     
    #13
    Greggor25
    New Member
    • Total Posts : 12
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/01 14:14:41
    • Status: offline
    Re: VPN Tunnel stays up but not traffic passing from our end 2019/07/12 07:34:36 (permalink)
    0
    The lifetime settings match on both ends.  We finally were able to get our MPLS circuit fixed so I cut over all the traffic to that circuit and everything is working fine.  For the time being I will leave the VPN for failover. 
    #14
    Jump to:
    © 2019 APG vNext Commercial Version 5.5