Troubleshooting Tip: The routing table update attempted by the link monitor does not work for dial-up IPsec VPN types

Description

This article explains why the link-monitor does not work with dial-up type IPsec VPN.

Scope

FortiGate.

Solution

In a dial-up IPsec VPN setup, the routing table is not updated even if the link-monitor status is changed to dead as follows.

diagnose sys link-monitor status
Link Monitor: LinkVPN, Status: dead, Server num(1), HA state: local(dead), shared(dead)
Flags=0x3 init no_src_route, Create time: Thu Jan 30 16:16:47 2025
Source interface: VPN-A (1438)
Source IP: 192.238.11.78
Interval: 500 ms
Service-detect: disable
Diffservcode: 000000
Class-ID: 0
Peer: 192.238.11.77(192.238.11.77)
Source IP(192.238.11.78)
protocol: ping, state: dead
Packet lost: 100.000%
MOS: 4.350
Number of out-of-sequence packets: 0
Recovery times(0/5) Fail Times(3/5)
Packet sent: 14, received: 0, Sequence(sent/rcvd/exp): 15/0/0

get router info routing-table all | grep VPN
S 192.233.181.0/26 [5/0] is directly connected, VPN-A, [1/0]
S 192.234.181.0/26 [5/0] is directly connected, VPN-A, [1/0]
S 192.235.181.0/26 [5/0] is directly connected, VPN-A, [1/0]
S 192.236.181.0/26 [5/0] is directly connected, VPN-A, [1/0]
S 192.237.181.0/26 [5/0] is directly connected, VPN-A, [1/0]
C 192.238.11.76/30 is directly connected, VPN-A
C 192.238.11.78/32 is directly connected, VPN-A
C 192.239.11.76/30 is directly connected, VPN-B
C 192.239.11.78/32 is directly connected, VPN-B
S 192.240.181.0/26 [5/0] is directly connected, VPN-A, [1/0] 

Reason: This is expected behavior. It will not affect the routing table if the link-monitor is configured on a dial-up tunnel with the net-device disabled(default).

Workaround:

For 1-to-1 Tunnels: On phase1, the tunnel should be converted from the 'dynamic' type to the 'static' static:

config vpn ipsec phase1-interface
   edit "name-of-the-tunnel"
       set type static
       set remote-gw <remote_public_ip>
   next
end

For multi-site dial-up: BFD on static routes with a gateway IP should be used, where:

• 'set dst z.z.z.z y.y.y.y' is the destination IP address.

• 'set gateway z.z.z.z' is the gateway IP address.
  
  

config router static
   edit 1
       set dst z.z.z.z y.y.y.y 
       set device "Name-of-the-tunnel"
       set gateway z.z.z.z
       set bfd enable
   next
end

Related article:

• Technical Tip: Configuring Bidirectional Forwarding Detection (BFD) for static routes