Skip to main content
adbgz
adbgz
Explorer
March 28, 2024
Question

HOB/SPOKES : VPN Dial-UP issue when spoke chang IP public

  • March 28, 2024
  • 4 replies
  • 2056 views

Hi,
I had configured two VPNs/Site betwen HQ and sites (Hub/spoke) for resilience. One of two VPN is a Dialup over 4G and the other is an IPSEC site-to-site over Radio links (Fluidmesh). no loadbalanacing or SDWAN in this architecture.

 

So my problem is when the Spoke chang the IP Publics (VPN dialup over 4G), is creating a new phase 1/phase2 on Hub but the old phase1/phase2 still stuck on Hub so i get 2 connections dialup over the same vpn and is causing disconnecting on communication between 2 sites.dial-up.png

 

4 replies

ozkanaltas
ozkanaltas
Valued Contributor III
March 28, 2024

Hello @adbgz ,

 

Did you configure dpd (dead peer detection) on your ipsec configuration? DPD will detect peer status and change tunnel status to down for the old tunnel. 

    adbgz
    adbgzAuthor
    Explorer
    March 28, 2024

    hi ozkanaltas,

    I disabled it, because I need the tunnel stay up even if there is no traffic, because the equipment on the remote site only responds to commands launched from the HQ, so in most time there is no traffic in tunnel and i think if i applied dpd it will put the tunnel (the good one) down. 

    ozkanaltas
    ozkanaltas
    Valued Contributor III
    March 28, 2024

    Hi @adbgz ,

     

    I think you can use dpd with on-demand mode. This mode is triggered if one peer sends a packet and the remote side does not respond to this package, dpd removes the tunnel. 

     

    You can read this article about dpd on dial-up tunnels.

     

     

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explanation-of-the-DPD-effect-on-a-dialup-IPsec/ta-p/192495

     

     

     

     

      adbgz
      adbgzAuthor
      Explorer
      March 28, 2024

      I think I'm going too fast, both tunnels are falling down when i applied dpd. That's what I was afraid of.

      istvanmarlok
      istvanmarlok
      Visitor III
      February 13, 2025

      Hi @adbgz 

       

      Did you find a solution for that? I have the same problem (when there is an IP change on 4G, the VPN dies). I tried some config change but nothing helped on that.

       

      Thank you!

      Terms & ConditionsAccessibility statement