Technical Tip: Use of 'link-monitor' to detect IPsec ESP (IPsec payload) being blocked

Description

This article describes a scenario where Spoke has primary and backup IPsec tunnels to the Hub. Normally IPsec DPD can detect path connectivity and trigger failover to the backup IPsec tunnel.

But since DPD use ISAKMP packet which is on UDP port 500.
If ESP (IP protocol port 50) is somehow blocked along the path, it cannot be detected. 
In such case, 'link-monitor' can be configured to regularly ping a client IP behind the remote tunnel and detect data path (ESP, IP protocol port 50) connectivity issue.

Solution

Spoke FGT B.

Configure a loopback interface to be used as source IP for the ping in 'link-monitor'. The source IP can be any IP in the FortiGate . This is just an example.
A loopback IP has the benefit that it will not go down like a physical port.

config system interface
    edit "Test_Loopback1"
        set vdom "root"
        set ip 9.9.9.1 255.255.255.255
        set allowaccess ping
        set type loopback
next

Configure IPsec Phase2 of the primary tunnel to advertise the source IP 9.9.9.1 to Hub in its Phase 2 SA.

config vpn ipsec phase2-interface
    edit "To_hub_Loopback"
        set phase1name "To_hub1"
        set proposal des-sha1
        set auto-negotiate enable
        set src-subnet 9.9.9.1 255.255.255.255
    next

Configure 'link-monitor' to ping a remote client side IP behind the IPsec tunnel using the loopback IP above as source.

config system link-monitor
    edit "test-IPsec-path"
        set srcintf "To_hub1"     <----- Phase1 name of the tunnel to be monitored.
        set server "20.20.20.102" <----- Some-ip-on-the-other-side-of-the-tunnel.
        set source-ip 9.9.9.1     <----- Some-local-ip-as source.
    next
end

In the backup tunnel (e.g. 'To_hub2' in example below), 'monitor hold down' should be configured to prevent the backup from switching back to the primary immediately. 'hold-down-delay' should be configured (e.g. 20 seconds in example below) to wait until 'link-monitor' has verified the path is good before switching back to the primary.

config vpn ipsec phase1-interface
    edit "To_hub1"
        set interface "wan1"
        set mode aggressive
        set peertype any
        set net-device enable
        set proposal des-sha1
        set localid "spoketest1"
        set dpd on-idle
        set dhgrp 2
        set remote-gw 10.21.21.21
        set psksecret ENC xxxxx
    next
    edit "To_hub2"
        set interface "wan2"
        set mode aggressive
        set peertype any
        set monitor-hold-down-type delay   
        set monitor-hold-down-delay 20
        set net-device enable
        set proposal des-sha1
        set localid "spoketest1"
        set dpd on-idle
        set dhgrp 2
        set remote-gw 10.21.21.21
        set monitor "To_Hub2"
        set psksecret ENC xxxx
next

When 'link-monitor' detects the path is down, logging will show such event.

Related documents:

Technical Tip: Link monitor
FortiGate IPsec Phase‑1 Interface Configuration via CLI
FortiGate System Link Monitor Configuration via CLI