Getting Packet Drop issue on IPsec VPN Tunnel, after upgrade the FortiOS v7.4.3

Forum|Forum|2 years ago
May 13, 2024
2 replies
4168 views

Dear All.

We've encountered packet drop issues on the IPsec VPN tunnel between our FortiGate and AWS after upgrade FortiOS v7.4.3. Disabling the 'NPU Offload' has alleviated some of the packet loss problems, but we're still experiencing frequent packet loss, averaging around 5-6%.

In order to address this persisting issue, could you please provide some solutions or recommendations for resolving it?

With regards,

Bhaskar Rao

FortiGate

hbac

Staff

Hi @bhaskarrao,

Did you try disabling 'replay detection'? There is a known issue with bug ID 1003830. Please refer to https://docs.fortinet.com/document/fortigate/7.4.3/fortios-release-notes/236526/known-issues

Regards,

bhaskarraoAuthor

New Member

We did disable that option in phase-2, but unfortunately, the issue persists unchanged. We haven't seen any improvement despite our efforts.

is there any other workaround to fix this issue.

hbac

Staff

@bhaskarrao,

Do you have multiple tunnels going to AWS or just one? You can take packet captures on both sides to see where the packets are lost.

Regards,

ezhupa

Staff

Hello,

What model is your FGT device?
Is the tunnel between physical FGT and FGT located in AWS?
Any logs being generated on the end devices such as ESP packet errors, HMAC validation errors that coincide with the drops you experience?
If the device is a F series FGT disabling offloading and replay detection should resolve the issue.

bhaskarraoAuthor

New Member

Hi,

The FGT model is 500E and IPsec VPN tunnel between FGT and AWS.

We tried disabling offloading and replay detection but issue remain same.

Please find the log file for your reference.

Sign up

Login with SSO

Login to the community

Login with SSO