ADVPN Tunnel Packet Loss Issues

Hello @ctyctyctctcty 

Try running a sniffer on the source and destination side to see where the loss is occurring.

dia sniffer packet "host x.x.x.x and icmp" 4 0 l

Try using the above command, where x.x.x.x is the source IP address that you have on performance SLA. Run the sniffer command on the source as well as on destination FortiGate if both sides are FortiGate.
Check if one side is sending and other side is not receiving or other side receives but the returning traffic is not reaching the original source?

Hello @Umer221 

I checked the VPN event logs on the hub, and it looks like whenever one tunnel (like to Spoke-A) connects, the other tunnel (to Spoke-B) disconnects. This keeps happening back and forth, so only one tunnel is active at any time, which is causing around 50% packet loss.

Phase 1 seems fine, but something seems off with Phase 2. I’ve attached a screenshot showing this pattern in the logs. Here’s the current Phase 2 config on all three devices:

set phase1name "xxxxxx"

set proposal aes128-sha256
set keepalive enable

Could you give me some suggestions about this?

Thank you!

Thank you for responding @ctyctyctctcty,

Could you check how the destination is responding configured in the Performance SLA? How SD-WAN is configured and what are the priorities.

The Phase 1 setup seems stable, but Phase 2 is where the problem arises.

This issue requires detailed analysis. I would recommend reaching out to TAC support for in-depth troubleshooting, as this issue requires in depth troubleshooting.

@Umer221 
Disabling the add-route option in the VPN configuration resolved the issue.
Thank you for your guidance.