Hello again jpapic,
I found this answer, can you tell us if it helps, please?
When dealing with LTE connectivity and dynamic IP addresses, it's not uncommon to experience issues like the ones you're facing. Here's a breakdown of the situation and some recommendations:
Expected Behavior with LTE Dynamic IP:
Dynamic IP Changes: LTE connections often have dynamic IP addresses that can change based on the carrier's settings. This can lead to temporary disruptions in connectivity, especially if the IP change is not handled gracefully by the network devices.
Configuration Recommendations
-
Dead Peer Detection (DPD): Ensure that DPD is enabled in your IPsec VPN configuration. DPD helps detect when a peer is no longer responding and can trigger a renegotiation of the tunnel.
-
Auto-Negotiate: Enable auto-negotiate for phase 2 of your IPsec configuration. This setting allows the tunnel to automatically renegotiate when necessary, which can help maintain connectivity.
-
Keepalive Settings: Implement keepalive settings to regularly check the status of the connection. This can help in quickly detecting and responding to changes in the network state.
-
FortiGate VPN Event Logs: Monitor the FortiGate VPN event logs to identify if the tunnel up/down events correlate with LTE link state changes. This can provide insights into whether the IP changes are causing the disruptions.
SD-WAN and Tunnel Monitoring
-
SD-WAN: If you are using SD-WAN, ensure that it is configured to handle failover scenarios. SD-WAN can help manage multiple WAN links and provide redundancy, which might mitigate the impact of IP changes.
-
Tunnel Monitoring: Enable tunnel monitoring to continuously check the status of the VPN tunnel. This can help in quickly detecting when the tunnel goes down and initiate a reconnection process.
Best Practices
-
Regular Monitoring: Continuously monitor the LTE connection and VPN tunnel status to quickly identify and address issues.
-
Carrier Consultation: Consult with your LTE provider to understand their IP assignment policies and see if there are options for a more stable IP assignment, such as a static IP.
-
Firmware Updates: Ensure that your FortiExtender and FortiGate devices are running the latest firmware versions, as updates often include improvements and bug fixes related to connectivity.
Follow-ups and Clarification Questions
- Have you checked the FortiGate VPN event logs for any specific error messages when the connection drops?
- Are there any specific configurations in place for DPD or auto-negotiate on your IPsec VPN?
- Is SD-WAN currently configured and in use in your network setup?
- Have you reached out to your LTE provider regarding the frequency of IP changes and potential solutions?
These steps and considerations should help in addressing the connectivity issues you're experiencing with the FortiExtender and LTE dynamic IP changes.
