Skip to main content
jminard
New Member
March 24, 2020
Question

60F IPSEC VPN Stops passing traffic

  • March 24, 2020
  • 5 replies
  • 8594 views

I deployed 2 different customers with a 60F at their main office and 60E's at their 3 remote sites last weeks. The VPNs come up and stay up, but at random times the VPNs will just stop passing traffic. If I bring the tunnels down from the main office, things immediately come back up (due to auto-negotiate and auto-rekey being enabled) and traffic usually starts flowing right away again, but sometimes I have to bounce the tunnel on the remote device as well. These are very basic setups, which I've done many times before with 60D and 60E devices. Anyone else have issues like this with the 60F? Everything is running 6.0.9, and I'm afraid to try 6.2.3 since the known issues list is pretty long and I think it will do more harm than good to upgrade. I'm working on getting them swapped for E's to see if it is the new hardware series. 

    5 replies

    ByterunnerHome
    New Member
    March 24, 2020

    Hi,

    if keepalive on?

    regrads Byte

    jminard
    jminardAuthor
    New Member
    March 24, 2020

    yes, auto-negotiate is enabled, which in turn appears to automatically enable auto-rekey as it shows as enabled and grayed out in the gui, so I can't de-select it in the GUI. And from what I read in https://kb.fortinet.com/kb/documentLink.do?externalID=12069, they can be used together. But when I look at the configs, I only see set auto-negotiate enable on the various phase 2's. I might have to see if I can manually enter the "set keep alive enable" command in the CLI.

    jminard
    jminardAuthor
    New Member
    March 24, 2020

    So it appears I can't use "set keepalive enable" (I mistakenly had a space in my last post), if I already have "set auto-negotiate enable"  in the phase 2 settings. So would that confirm that if auto-negotiate is enabled, then keepalive is automatically enabled like it appears to be in the GUI? I searched before and couldn't really find confirmation from Fortinet.

    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT