Hot!Site to Site IPSec goes one way after random number of days

Author
jokes54321
New Member
  • Total Posts : 16
  • Scores: 2
  • Reward points: 0
  • Joined: 2016/04/14 11:05:50
  • Status: offline
2020/10/06 15:34:24 (permalink)
0

Site to Site IPSec goes one way after random number of days

Last week we deployed a few Fortigate F models (60F and 100F) to replace D models at a few of our branch sites. At each of these sites an HA pair was put in place.
 
Fortigate to Fortigate route based IPSec tunnels were established and at least 3 times now, we've gotten calls that the systems were down.
 
  • I was able to log into both ends and the tunnel showed up on both sides.
  • With packet tracers running on each side, I was able to see the following in the trace
    • Ping from the Datacenter side entered the internal interface
    • Ping egressed the tunnel interface
    • Ping ingressed the tunnel interface on the remote firewall
    • Ping egressed the internal interface on the remote firewall
    • Ping Reply ingressed the internal interface on the remote firewall
    • Ping DID NOT egress the tunnel interface on the remote firewall
 
I dropped all Phase 2 on the tunnel and when it came back up the issue would be resolved, until the next time.
 
I verified the IPSec configurations match 100% on both sides, so I'm at a loss. Any suggestions?
 
Denny
 
 
#1

2 Replies Related Threads

    Toshi Esumi
    Expert Member
    • Total Posts : 2275
    • Scores: 219
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Site to Site IPSec goes one way after random number of days 2020/10/06 16:24:29 (permalink)
    0
    You need to run "flow debug" at the remote FGT to see why the ping replies are dropped there. I think you have plenty time to research how to run flow debug even if you haven't done before (some document, blogs, etc. available) before it happens next time.
    #2
    boneyard
    Gold Member
    • Total Posts : 266
    • Scores: 14
    • Reward points: 0
    • Joined: 2014/07/30 11:15:18
    • Status: offline
    Re: Site to Site IPSec goes one way after random number of days 2020/10/10 00:25:15 (permalink)
    0
    • Ping DID NOT egress the tunnel interface on the remote firewall
    just wondering how you saw this? with regular FortiGate diagnose sniffer you only see traffic entering the VPN tunnel in this case i believe, the next place you would see something is on the local firewall.
     
    diagnose debug flow is worth a try, although i wonder if it will notice this if the traffic does enter the tunnel fine.
    #3
    Jump to:
    © 2020 APG vNext Commercial Version 5.5