Skip to main content
rmukherjee
Staff
rmukherjee
Staff
November 4, 2025

Technical Tip: IPsec VPN stops passing traffic with DPD failure status despite no failure in actual DPD messages

  • November 4, 2025
  • 0 replies
  • 5639 views
Description

This article describes an issue where the DPD status of a tunnel may fail, causing the interface to be marked as inactive.
Scope

FortiOS v7.4.4 and later, v7.6.0 and later.
Solution

Symptoms:

  • Routes through the VPN tunnel become 'inactive' even though the tunnel's status is 'up', causing traffic failure.
  • Tunnel diagnostic commands show 'dpd failure', but the tunnel is not down.

 

Working scenario:

 

get router info routing-table database

S *> 0.0.0.0/0 [10/0] via IPSec tunnel 10.0.0.1, [1/0] <----- Route is active.

 

diagnose vpn tunnel list

name=IPSec ver=2 serial=1 10.56.6.245:4500->10.10.88.247:4500 nexthop=10.56.6.241 tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=1500 weight=1
bound_if=3 real_if=3 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=1 overlay_id=0

proxyid_num=1 child_num=0 refcnt=5 ilast=38 olast=0 ad=/0
stat: rxp=49592 txp=51122 rxb=4165728 txb=4294248
dpd: mode=on-idle on=1 status=ok idle=10000ms retry=3 count=3 seqno=1026

 

Non-working scenario:

get router info routing-table database

S > 0.0.0.0/0 [10/0] via IPSec tunnel 10.0.0.1 inactive, [1/0] <----- Route listed as inactive.

 

diagnose vpn tunnel list

name=IPSec ver=2 serial=1 10.56.6.245:4500->10.10.88.246:4500 nexthop=10.56.6.241 tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=1500 weight=1
bound_if=3 real_if=3 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=1 overlay_id=0

proxyid_num=1 child_num=0 refcnt=5 ilast=0 olast=36 ad=/0
stat: rxp=1198 txp=0 rxb=100632 txb=0
dpd: mode=on-idle on=1 status=fail idle=10000ms retry=3 count=0 seqno=1026

 

The issue has multiple possible observed triggers, including changing tunnel configuration and HA failover events.

 

Workaround:

Bringing the tunnel down and back up or rebooting the FortiGate temporarily restores VPN functionality, but the issue may reoccur. Disabling DPD in the tunnel configuration does not serve as a workaround.

 

Solution:

This issue has been resolved in:
v7.4.9 (available to download from the Fortinet support portal).
v7.6.5 (available to download from the Fortinet support portal).
v8.0.0 (scheduled to be released in March 2026).
These timelines for firmware release are estimated and may be subject to change.

See Issue ID 1180987 in FortiOS v7.4.9 Release Notes | Resolved Issues.

 

The fix optimizes the DPD status check and update process to prevent inactive route behavior.

 

Related articles:
Terms & ConditionsAccessibility statement