Troubleshooting Tip: Security fabric connection failing over IPsec tunnel

Follow these troubleshooting steps:

1. Make sure the tunnel is up and running with traffic on both sides of the tunnels (Head Office and Branch).
   
   
2. Try to connect the upstream FortiGate with a loop-back IP. It should show a 'connecting' state, but never 'connected'.

Make sure the IP addresses are configured on the VPN interface.

Example:

The following topology shows a downstream FortiGate (Branch) connected to the root FortiGate (HQ) over IPsec VPN to join the Security Fabric:

Configure the IPsec VPN interface IP address which will be used to form the Security Fabric.

• Go to Network - > Interfaces.
• Edit the Tunnel in question.
• Set the Role to LAN.
• Set the IP/Network Mask to 10.10.10.1/255.255.255.255.
• Set the Remote IP/Network Mask to 10.10.10.3/255.255.255.0.

3. Make sure that phase2 selectors allow the source and destination IP addresses.
   
   
4. If the issue still surfaces, test the fabric connectivity using a sniffer:

diagnose sniffer packet any “port 8013” 6 0 l

Note:

• By default,  Port 8013 (set upstream-port 8013) is the port used for security fabric syncing.
• There should be no doubt on adding remote IP even in the case of dial-up IPsec VPN.
• Configuring IP addresses is still possible on VPN interfaces for dial-up VPN, similar to ADVPN, which is a dial-up VPN too. This is also valid for a site-to-site IPsec VPN.

Related article: 

Troubleshooting Tip: Troubleshooting Security Fabric Issues