intermittent VPN drops on FortiGate, anyone else facing this?

Hey Sarah,

Welcome! I’d start by checking the FortiGate logs around the drop times. Also worth checking DPD/keepalive, Phase 1/2 lifetime mismatches, and packet loss during peak hours. That usually helps narrow down whether it’s the VPN config or the underlying connection.

can you confirm if the issue is only with traffic flow or VPN itself is flapping?

Hi Sarah,

Building on Sjoshi's question, the first thing I would distinguish is whether the IPsec tunnel itself is going down/re-establishing, or whether the tunnel remains up while traffic through it is intermittently lost.

If the tunnel is actually flapping, check the VPN events around the exact drop time for DPD, IKE, or SA/rekey events. If the tunnel remains up but traffic stops, investigate the traffic path and Phase 2 selectors rather than changing DPD settings blindly.

Fortinet's current FortiOS 8.0 documentation provides an IPsec VPN troubleshooting workflow that can help narrow down which part of the VPN is failing:

FortiOS 8.0 — VPN IPsec troubleshooting

So before changing DPD or keepalive values, I would first establish whether the tunnel or the traffic is actually dropping. That distinction should narrow the investigation considerably.

Hope this helps narrow down the cause.

Hi Sarah,

I too am facing the same issues on an IPSec VPN tunnel, we are not using RADIUS currently as our firmware was too old (FIPS), now running 7.2.8 and users are randomly disconnecting during the day, myself included. I would be very interested in hearing about DPD and keepalive tuning. We used the Fortinet best practices and some other feedback online for the original setup. In my case, yes the tunnel is dropping for that client. We are also using EMS, and 7.2.7.2003 for the FortiClient. I am not interested in upgrading because it’s finally “stable” after some of the most horrendous releases in 7.2.3, .4, .5. Like, black screening, locking all USB devices so you can’t wake up the computer, locking ethernet so you can’t even remote to it. Can’t believe they made software this bad. 

Same boat here — 7.2.8 with IPSec, no RADIUS (old FIPS firmware held us back too), and random disconnects throughout the day, including for me. Confirmed the tunnel itself is dropping, not just the client hanging. Also on EMS + FortiClient 7.2.7.2003, and honestly not touching that version either after how bad .3-.5 were. If anyone's found solid DPD/keepalive settings that actually reduce these drops, I'd love to hear specifics — happy to test and report back.

Might be unrelated, but I’ve noticed something similar with our split tunnel FortiClient SSL VPN. Have two continuous pings going - one to 1.1.1.1 and the other to a device across the VPN. intermittently / Transiently, I’ll see the pings to cloudflare continuing on like normal, but while that’s happening (ruling out a poor home network connection), the pings to our on-prem host will just freeze - and then I’ll get responses about 10 to 15, sometimes 30, seconds later. 

We just signed up for FortiClient Cloud EMS, so I’m using the new client (7.4.8.1977 - Mature) and are terminating onto our FortiGate on 7.4.12. I didn’t notice this issue at first, but it’s much more noticeable lately. VPN connection doesn’t drop, just massive amount of lag: