Dialup L2TP IPSEC Dynamic routing after upgrage from 6.4.15 to 7.0.X

Question

Hello,I am using an FG 80F with FortiOS version 6.4.15, connected to several Mikrotik devices via dial-up L2TP IPsec VPN. For dynamic routing, I use the RIP v2 protocol to enable communication between clients behind the devices and other remote networks.When upgrading to FortiOS 7.0.X, I followed the manual steps to adjust L2TP: adding a static route to the 192.168.254.0/24 network for l2t.root and modifying the firewall policy. While the VPN connections are established, RIP does not function, and routes to remote Mikrotik networks are not created.Below is my routing table in version 6.4.15 with the RIP protocol functioning correctly. S* 0.0.0.0/0 [10/0] via 181.120.228.253, wan1S 92.62.234.133/32 [15/0] via 92.62.234.133, VPN MikrotikS 178.255.168.3/32 [15/0] via 178.255.168.3, VPN MikrotikS 178.255.168.18/32 [15/0] via 178.255.168.18, VPN MikrotikS 178.255.168.25/32 [15/0] via 178.255.168.25, VPN MikrotikS 178.255.168.27/32 [15/0] via 178.255.168.27, VPN MikrotikS 178.255.168.28/32 [15/0] via 178.255.168.28, VPN MikrotikS 178.255.168.53/32 [15/0] via 178.255.168.53, VPN MikrotikS 178.255.168.115/32 [15/0] via 178.255.168.115, VPN MikrotikS 178.255.168.220/32 [15/0] via 178.255.168.220, VPN MikrotikC 181.120.228.252/30 is directly connected, wan1R 192.168.3.0/24 [120/2] via 192.168.254.3, ppp2, 05:04:43R 192.168.4.0/24 [120/2] via 192.168.254.4, ppp3, 01w0d14hR 192.168.10.0/24 [120/2] via 192.168.254.10, ppp9, 5d23h25mR 192.168.11.0/24 [120/2] via 192.168.254.2, ppp1, 2d23h07mR 192.168.14.0/24 [120/2] via 192.168.254.5, ppp4, 00:58:04R 192.168.15.0/24 [120/2] via 192.168.254.9, ppp8, 08:32:09R 192.168.16.0/24 [120/2] via 192.168.254.6, ppp5, 1d12h40mR 192.168.17.0/24 [120/2] via 192.168.254.8, ppp7, 09:41:22R 192.168.18.0/24 [120/2] via 192.168.254.7, ppp6, 22:13:32C 192.168.30.0/24 is directly connected, IPC VLANC 192.168.100.0/24 is directly connected, internal1C 192.168.200.0/24 is directly connected, VOICEC 192.168.254.1/32 is directly connected, ppp3is directly connected, ppp9is directly connected, ppp1is directly connected, ppp5is directly connected, ppp6is directly connected, ppp7is directly connected, ppp8is directly connected, ppp2is directly connected, ppp4C 192.168.254.2/32 is directly connected, ppp1C 192.168.254.3/32 is directly connected, ppp2C 192.168.254.4/32 is directly connected, ppp3C 192.168.254.5/32 is directly connected, ppp4C 192.168.254.6/32 is directly connected, ppp5C 192.168.254.7/32 is directly connected, ppp6C 192.168.254.8/32 is directly connected, ppp7C 192.168.254.9/32 is directly connected, ppp8C 192.168.254.10/32 is directly connected, ppp9  I would greatly appreciate any ideas on what additional changes might have occurred after the upgrade and what areas I should focus on.

ezhupa · Answer

Hello,

If you have multiple VPN tunnels configured you might be matching the below article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dialup-IPSEC-issues-after-upgrading-v7-2-6-and-v7/ta-p/283504

Overlapping of routes caused VPN tunnels to flap and therefore not able to establish correctly. Since the RIP routes are using the VPN to advertise their routes if the tunnel is not stable, routes will not get added.
Otherwise, if the VPNs stay up but no traffic can pass through an IKE debug would be needed on the FGT to see how the negotiation is going.

Hope this helps!

Sign up

Login with SSO

Login to the community

Login with SSO