Troubleshooting Tip: IPsec connection fails to progress at DH secret creation due to IKECRYPT Daemon Crash on FortiGate

An intermittent or continuous crash of the IKECRYPT daemon can prevent the IPSec VPN connection from being established, as the Diffie-Hellman (DH) shared secret calculation relies on the normal operation of the IKECRYPT daemon.

ike V=root:0:eb5a3329d5007645/0000000000000000:287: SA proposal chosen, matched gateway Test_IPsec
ike V=root:0:Test_IPsec:Test_IPsec: created connection: 0x9a00330 5 24.32.97.69->47.223.57.89:500.
ike V=root:0:Test_IPsec:287: processing notify type NAT_DETECTION_SOURCE_IP
ike V=root:0:Test_IPsec:287: processing NAT-D payload
ike V=root:0:Test_IPsec:287: NAT detected: PEER
ike V=root:0:Test_IPsec:287: process NAT-D
ike V=root:0:Test_IPsec:287: processing notify type NAT_DETECTION_DESTINATION_IP
ike V=root:0:Test_IPsec:287: processing NAT-D payload
ike V=root:0:Test_IPsec:287: NAT detected: PEER
ike V=root:0:Test_IPsec:287: process NAT-D
ike V=root:0:Test_IPsec:287: FEC vendor ID received FEC but IP not set
ike 0:Test_IPsec:287: FCT EAP 2FA extension vendor ID received
ike V=root:0:Test_IPsec:287: responder preparing SA_INIT msg
ike V=root:0:Test_IPsec:287: generate DH public value request queued
ike V=root:0:Test_IPsec:287: IKEv2 phase1 DH failed <-----
ike V=root:0:Test_IPsec:287: schedule delete of IKE SA eb5a3329d5007645/a1b50b1f4b77cedc
ike V=root:0:Test_IPsec:287: scheduled delete of IKE SA eb5a3329d5007645/a1b50b1f4b77cedc

The ikecryptd process ID may be seen constantly changing indicating frequent crashes and without a trace in the output of 'diagnose debug crashlog read'.

FortiGate-40F # diagnose sys process pidof ikecryptd
15164
FortiGate-40F # diagnose sys process pidof ikecryptd
15171
FortiGate-40F # diagnose sys process pidof ikecryptd
15177

This issue may occur when the FortiGate device is running low on system memory. Ensure that the device has sufficient free memory and is not entering conserve mode.

For memory optimization recommendations, refer to the following articles:

• Technical Tip: FortiGate is entering into Conserve Mode during FortiGuard Updates
• Technical Tip: How to optimize memory consumption for smaller FortiGates
• Technical Tip: Free up memory to avoid conserve mode
  
  

Workaround:

Disable dh-multiprocess from 'config system ike' to shift the DH Secret Creation task from ikecryptd to ike daemon.

Note: The Ikecryptd daemon is used to improve performance and overall IPsec tunnel setup rate by moving expensive DH calculations out of the single iked process and into separate ikecryptd processes, which can more effectively use multiple CPUs.