Skip to main content
patnor
patnor
New Member
August 26, 2005
Question

Autokey Keep Alive not working

  • August 26, 2005
  • 3 replies
  • 5159 views
For one of our customers we want a certain number (3) of IPSec VPN tunnels to remain open, even if there is no traffic going through the tunnel. To accomplish this I enabled the " Autokey Keep Alive" setting in VPN --> IPSEC --> Phase 2 --> Edit VPN Tunnel --> Advanced. This configuration setting does not seem to work. I don' t seem to be able to find out why this is not working. I do notice that when changing the setting from enabled to disabled and vice versa, the FortiGate brings the tunnel up once. Using the ping generator would be a possible solution if you would be able to add more than two src/dst IP' s. Our customer is using a FGT 500A, 2.80, build393. Any help would be greatly appreciated, Patrick.

    3 replies

    A
    Anonymous_User
    Contributor III
    August 31, 2005
    Hi, sorry but my English is little There is any problems with the ISP, I recommend you that tou use Nat-traversal, for this you need open UDP: 500 and 4500 to Sites. Your Site-Site is Fortigate-Fortigate? bye
    patnor
    patnorAuthor
    New Member
    September 8, 2005
    Aenriquez, our tunnels are from FortiGate to some Nortel device. There is not actually a problem with the tunnels. They come up and transport the traffic. They just go down after timeout expiration and do not automatically come up. To avoid the tunnels going down, we wanted to use the autokey keepalive setting. Patrick
    A
    Anonymous_User
    Contributor III
    September 6, 2005
    Hi patnor, I admit that the autokey sounds like it should be what you are looking for. But I used the ping generator, works for me like a charm: VPN --> ISEC --> Ping Generator. Hope that helps Stefan
    patnor
    patnorAuthor
    New Member
    September 8, 2005
    Stefan, the ping generator indeed works just like we want it to. But you can only use it for 2 tunnels and we have got total of 3 tunnels. Patrick
    A
    Anonymous_User
    Contributor III
    September 8, 2005
    hello, it seems, that nortel does not support the " keep alive" funktion. are the nortels allowed to reach each other? maybe you can try the" ping generator" to keep alive all the three tunnels. the first ping comes from the forti and goes to nortelA, the second ping comes from nortelB and goes to nortelC. that' s not the best method, but ... regards Andy
    Terms & ConditionsAccessibility statement