Skip to main content
skrymi
Staff
skrymi
Staff
June 17, 2026

Troubleshooting Tip: IPsec traffic dropped with 'No Matching IPsec Selector' in Hub-and-Spoke SD-WAN topology

  • June 17, 2026
  • 0 replies
  • 34 views

Description

This article explains the scenario where the traffic is being dropped on the IPSEC Tunnel Hub and Spoke topology.

Scope

FortiGate.

Solution

In a Hub-and-Spoke SD-WAN deployment using IPsec VPN tunnels, traffic between different networks or hosts is successfully transmitted through the IPsec tunnel. However, other traffic matching the same routing policy is dropped.

SD-WAN health checks remain operational. Routing appears correct. However, an error can be identified in the debug flow logs with the following error:

id=65308 trace_id=13 func=resolve_ip_tuple_fast line=6040 msg="Find an existing session, id-f1283352, original direction"

id=65308 trace_id=13 func=ipv4_fast_cb line=53 msg="enter fast path"

id=65308 trace_id=13 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface TEST, tun_id=0.0.0.0"

id=65308 trace_id=13 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel TEST, tun_id=x.x.x.x, vrf 0"

id=65308 trace_id=13 func=ipsec_common_output4 line=917 msg="No matching IPsec selector, drop"

 
The solution is to disable Auto-Discovery sender on the Hub Phase1 interface:

config vpn ipsec phase1-interface

        edit "hub-phase1"

            set auto-discovery-sender disable

        next

end


After applying the change, verify that traffic is successfully forwarded through the intended IPsec tunnel and that the debug flow no longer reports 'No matching IPsec selector, drop'.

Terms & ConditionsAccessibility statement