| Description | This article describes the issue of a static route disappearing from the routing table in FortiGate for the IPSec tunnels. The static route is configured with a fixed local and remote IP address, resulting in a static route being installed in the routing table, directing traffic for the remote IP via the tunnel interface. |
| Solution | To resolve the issue of a static route disappearing from the routing table in FortiGate, follow these steps: -
Verify if there's any link monitor in the configuration for the tunnel interface that has the missing route in 'get router info routing-table all'. Run the CLI command 'diagnose sys link-monitor status' to check the link monitors. - Verify that the Kernel route is not interfering with the static route. Run the CLI command 'get router info kernel' to check the Kernel route.
- Delete the Kernel route using the CLI command 'diagnose ip route delete <interface name> <IP address> <subnet mask> <gateway> <distance> <priority> <vf number>' if necessary.
- Re-add the static route and verify that it is installed in the routing table.
- Check the DPD or Dead Peer Detection mode on both sides of the IPsec tunnel. If it is set to 'on-demand', change it to 'on-idle'.
- DPD On-Demand sends probes only when traffic resumes after inactivity, minimizing overhead but potentially delaying detection if the peer is down during idle periods.
- DPD On-Idle sends probes periodically during idle times, ensuring quicker detection of peers at the cost of slightly more background traffic.
It is recommended to configure DPD to 'on-idle' on both sides of the IPsec tunnel to maintain accurate knowledge of the peer's status and prevent the static route from disappearing unexpectedly.
Related articles:
Technical Tip: Configuring DPD (dead peer detection) on IPsec VPN
Technical Tip: Prevent removal of all static routes when link-monitor is failing
|
