IPSEC VPN failure after 6.2.3 update

[James_G]

Had an issue with the 6.2.2 to 6.2.3 update, possibly an undocumented change in default behavior. Traffic over IPSEC VPN was failing, after seeing that a new option had appeared in GUI for "Device Creation" I investigated further. I set the following under the phase1 interface and everything kicked in

set net-device disable

I don't understand fully, but thought I would share as it fixed my immediate issue :)

[Jirka1]

Hi James,

here is a very detailed explanation:  https://kb.fortinet.com/k....do?externalID=FD41498 (link at the bottom of the page). It also surprised me :)

Jirka

[James_G]

Detailed yes, but it reinforces my thought that the default must have changed to enabled between 6.2.2 and 6.2.3

[Jirka1]

That's weird.. I upgraded the two boxes from 6.2.2 and 6.2.3 and the settings remained the same.

[James_G]

Did you have the setting explicitly set, or just using default? Without it set, I found it defaults to enabled

[Jirka1]

James_G wrote:
Did you have the setting explicitly set, or just using default? Without it set, I found it defaults to enabled

I had it disabled and it remained disabled.

[Toshi_Esumi]

That "net-device" setting was introduced (or forced to be introduced) with 5.6, if I remember correctly. With previous versions, FTNT TAC said "it's always been enabled". But due to the 5.6's structural change, without explicit "disabled", establishment of dialup/dynamic IPsec and tearing down would be slower than policy based IPsec, which doesn't require any dynamic VPN interface creation.

You can see the explanation at below KB, and more in detail in the pdf presentation doc linked at the bottom of the KB.

https://kb.fortinet.com/kb/documentLink.do?externalID=FD41498

I noticed "set net-device enable" even for my static IPSec when I upgraded my test 60E to 6.2.3. Since it's static, no reason to be "enabled". But they must have decided to make everything "enabled" since it's safer. I don't know why yours don't work but must be something to do with the type of your IPSec and the previous config for "set tunnel-search { selectors | nexthop }" setting. I recommend you open a ticket to clarify why "enable" broke your IPSec.

I was to open a ticket to ask why they decided to enable it even for "static" IPsec. But since we decided not to go to 6.2.3, instead going to 6.0.8, I lost my reason to ask them at this time.

[James_G]

TAC call raised

I use FEC on this tunnel, I wonder if this is any way linked. Will update when I know more.

[James_G]

TAC are not helpful just yet, they responded that the set net-device should be set to "disable", and if I have further issues with it set to disable then get some trace results. Totally missing the point that the default has changed from disable to enable at 6.2.3, without any reference in notes.