IPsec Tunnel Established but Experiencing Intermittent Ping Timeouts

Question

Hi,

We have set up an IPsec VPN tunnel between our on-premises FortiGate firewall and Alibaba Cloud. Both Phase 1 and Phase 2 show as "up," and the tunnel is passing traffic. However, we are observing:

Severe slowness when accessing web applications hosted on Alibaba Cloud.
Intermittent ping failures (frequent "Request Timed Out" errors) across the tunnel.

Troubleshooting Done So Far:

Verified that encryption/authentication settings match on both ends.
Confirmed routing (static/Policy-Based) and firewall policies are correctly configured

May I know if there are any factors that could contribute to this issue?

Any insights or best practices to resolve this would be greatly appreciated!

Thanks.

knaveenkumar · Answer

Hi ,

Please refer the below document.

Tried to ping between two public ip continuously with repeatedly with packet 100 and check any packet loss

Also please test the path MTU from FortiGate site.
From a PC behind the FortiGate, please do the below:

ping <server ip> -f -l 1460

please reduce the value like 1450 , 1430 , 1410 and 1400 then check the status

Also, when you are facing the issue provide the below output

>> Connect to your FortiGate, run the below commands, and initiate a ping from source to destination

Putty1:
---------------------

diagnose debug reset
diagnose debug disable
diagnose debug flow show console en
diagnose debug flow show fun en
diagnose debug flow filter clear
diagnose debug flow filter saddr b.b.b.b -------------where b.b.b.b is the source IP address from where you are initiating the ping from
diagnose debug flow filter daddr y.y.y.y --------------where y.y.y.y is the destination IP address to where you are initiating the ping to
diagnose debug flow filter proto 1
diagnose debug flow trace start 100
diagnose debug enable

After 5-10sec, disable the logs by executing
diagnose debug disable
diagnose debug flow trace stop

Putty2:
---------------------
>>Simultaneously open an another session of putty, start the logging and run the below command

diagnose sniffer packet any "host y.y.y.y and icmp" 6 0 a --------------where y.y.y.y is the destination IP address to where you are initiating the ping to

Putty3:
--------------------
Diagnose VPN tunnel list
get router info routing-table database
get router info routing-table details b.b.b.b -------------where b.b.b.b is the source IP address
get router info routing-table details y.y.y.y --------------where y.y.y.y is the destination IP address
get router info routing-table all

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded