Skip to main content
Sowbaba
Sowbaba
New Member
July 4, 2026
Question

IPsec Remote Access VPN connected but RX packets remain 0 (intermittent)

  • July 4, 2026
  • 3 replies
  • 67 views

Hello everyone,

I'm experiencing an intermittent issue with an IPsec Remote Access VPN.

The VPN tunnel establishes successfully (IKE and IPsec SAs are up), and the client authenticates successfully. However, in some cases:

  • TX (sent) packets increase normally.
  • RX (received) packets remain at 0 bytes / 0 packets.
  • No internal resources are reachable.

One interesting observation is that the issue depends on the ISP. If I switch to another Internet provider, the VPN works immediately.

A few months ago, I had a similar issue that was resolved by setting the MTU to 1350, but this workaround no longer solves the problem.

I have reproduced the same behavior with:

  • FortiGate 7.4.x
  • FortiGate 8.0.0

This makes me suspect an MTU, fragmentation, or ISP-related issue, but I'm not sure where to investigate next.

Has anyone encountered a similar behavior?

3 replies

A
Abdulbaset
Visitor II
July 5, 2026

Hello

please try change the TCP-mss-sender  and  TCP-mss-receiver to value=1100 under related policy 
                                    

sjoshi
Staff
sjoshi
Staff
July 5, 2026

Hi ​@Sowbaba 

 

When the issue is happening, do you see any traffic reaching Fgt?

diag sniff packet any ‘host x.x.x.x and icmp’ 4 0 l » where x.x.x.x is the dst server ip

Thanks, Salon
Sowbaba
SowbabaAuthor
New Member
July 7, 2026

​@sjoshi ​@Abdulbaset 

Hi, and thank you for your feedback.

I finally resolved the issue by enabling NAT Traversal (NAT-T) in the VPN settings. I'm not exactly sure why this fixed the problem in this particular case, but since enabling NAT-T, the VPN has been working properly and the issue appears to be resolved.

    sjoshi
    Staff
    sjoshi
    Staff
    July 8, 2026

    Hi ​@Sowbaba 

     

    The core problem is that while IKE (UDP port 500/4500) traffic passes correctly, the actual data traffic (ESP, IP protocol 50) is being dropped or misrouted by the ISP's network.

    Why Enabling NAT Traversal (NAT-T) Resolved the IPsec VPN Issue
    Enabling NAT Traversal (NAT-T) resolved the issue where RX packets remained at 0 bytes and internal resources were unreachable because it encapsulated the ESP (Encapsulating Security Payload) traffic inside UDP packets, allowing it to bypass ISP-level filtering of native ESP protocol traffic.

    Refer:
    https://community.fortinet.com/fortigate-3/technical-tip-no-bytes-are-received-when-connected-to-ipsec-dialup-vpn-using-forticlient-186935

    Thanks, Salon
    Terms & ConditionsAccessibility statement