dpd_failure & esp_error - ipsec tunnels dropping all traffic pakcets

HI Khan

Have you resolved this fortigate vpn tunnel issue?..

Hi , 

This could be a bandwidth issue.

Dead Peer Detection (DPD) always check the availability of Remote peer and if find any problem with the accessibility it will bring down the tunnel once  the threshold value reaches.

Check the latency to any of the internet destinations while you face the problem. There is no other reasons for the outage especially you have mentioned that, during the time IPSec Client users also had the same problem. I would suggest to keep your eye on the band width utilization of the link which you are using for S2S and C2S IPSec VPNs.

Thanks

Nihas

Yes................Restarting the Fortigate is a solution only................

And regarding that esp_error, Fortinet TAC is saying that it is a known bug.

But After restarting unit, it didn't happened again, though i can still see the errors notification in the logs a about every day.

Hi Nihas,

You are right. But at the time of issue, i checked the bandwidth & ISP (internet) line first. It was ok. For internet line there was no drops. I can surely say that Bandwidth was ok at the time of issue.

There are many things so are not sure about some specific one. It is the Fortinet TAC who should point out the root cause.

Yea.. I understand. :)

I too had faced the similar kind of issues with my VPN's.

It was all about either the internet link problem or the remote peer IP reachability problem.

While restarting the box , all sessions will close and the band width pool becomes free.  So the tunnel wouldn't have any problem to re-establish the connectivity.  That's the basic logic behind on this specific issue.. !

Let's wait to hear the expert opinion from TAC guys.

Cheers..

Nihas

I was also lead to believe it could be an encryption problem, like the encryption was too high which slowed things down under a large amount of throughput and caused these problems... maybe someone can confirm