Skip to main content
sbaikadi
Staff
Staff
May 16, 2021

Technical Tip: IPsec tunnel traffic issues after upgrade to v6.2.4.

  • May 16, 2021
  • 0 replies
  • 2162 views
Description
IPSec tunnel does not pass traffic configured on interface with VLAN ID 1 after upgrade to v6.2.4.

Scope
For version 6.2.4 and above.

Solution
Both phases of IPSec tunnel shows up after upgrade to v6.2.4 but the tunnel traffic does not work.
The traffic enters firewall and the sniffer shows that packets are sent out but the packet is not forwarded out by NP.

Sniffer Output:
[FPM03] 11.211328 1-A3 in 192.168.10.5 -> 10.45.32.8: icmp: echo request
[FPM03] 11.211360 tunnel1 out 192.168.10.5 -> 10.45.32.8: icmp: echo request
[FPM03] 11.220450 1-A3 in 192.168.10.5 -> 10.45.32.8: icmp: echo request
[FPM03] 11.220465 tunnel1 out 192.168.10.5 -> 10.45.32.8: icmp: echo request
[FPM03] 16.074098 1-A3 in 192.168.10.5 -> 10.45.32.8: icmp: echo request
[FPM03] 16.074111 tunnel1 out 192.168.10.5 -> 10.45.32.8: icmp: echo request
From below output, the packets are received but not transmitted:
FGT (Vdom) # get vpn ipsec tunnel summary
'tunnel1' 10.1.1.1:0  selectors(total,up): 3/3  rx(pkt,err): 16006/0  tx(pkt,err): 88/0
This issue occurs when IPSec is created on an interface that is tagged with VLAN ID-1 and ingress port is un-tagged.

This is expected behavior from v6.2.4 onwards as vlan ID 1 is reserved in FOS 6.2.4.
Avoid using VLAN ID 1.
Any configurations that use a VLAN with vlan ID 1 will not work as expected.

After changing IPSec to other VLAN based settings, such as vlan10, this issue will be gone.
(Reference bug ID: 698527).

Workaround.

There are 2 workarounds:
1) Use VLAN ID other than 1 (or).
2) Disable npu-offload under IPSec Phase-1 interface:
# config vdom
    edit vdom1
# config vpn ipsec phase1-interface
    edit "tunnel1"
        set npu-offload disable
end

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!