Technical Tip: IPsec VPN Tunnel down with FGSP enabled
| Description | This article discusses when FortiGate Session Life Support Protocol (FGSP) is enabled on FortiGate to sync sessions/IPsec tunnels up with another FortiGate, the FortiGate does not support being the initiator. It can only respond to IPsec negotiations. |
| Scope | FortiGate. |
| Solution | If the FortiGate is a responder, IKE/IPsec FGSP is incompatible with the concept of being an initiator. Sample output: diagnose vpn ike gateway list name 'UAT_T1'
For the debug, follow the article: Troubleshooting Tip: IPsec Tunnel (debugging IKE).
IKE debug output:
iiB_FW_PRA_SEDE_ACTIVE # ike 0:UAT_T1:UAT_T1: IPsec SA connect 7 41.79.124.142->34.252.112.166:0
This issue can be fixed by the configuration shown below:
config system cluster-sync edit 1 set ipsec-tunnel-sync disable end
With the above configuration:
|