Skip to main content
Zato02
Zato02
Explorer II
September 12, 2025
Question

IPsec Tunnel Fails to Reconnect After Switching VDOM from Management to Non-Management and Reboot

  • September 12, 2025
  • 1 reply
  • 730 views

After changing the VDOM containing the IPsec tunnel interface on the FortiGate 60F (firmware version 7.4.3) to a non-management VDOM, the IPsec tunnel went down upon reboot. Prior to the reboot, the tunnel remained up.

After switching the VDOM back to the management VDOM, the tunnel came back up without any other changes.

Is there a requirement that the IPsec tunnel interface must be under the management VDOM at boot time in order to come up?

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
September 12, 2025

You need to share how exactly you "moved" the IPsec to another VDOM. 
My first question is how the new VDOM can get to the internet. Via the original VDOM interface after getting to it via vdom-link/npu-vlink? Where is the SNAT point? Or did you "move" the physical internet interface/port to the new VDOM? Did the public IP changed? and so on.

Toshi   

    Zato02
    Zato02Author
    Explorer II
    September 13, 2025

    Thank you for your reply.

    This is a preliminary response.

    I changed the management VDOM from the one originally hosting the IPSec tunnel interface to another VDOM, using the method described in the following URL: Fortinet Administration Guide – Management VDOM.

    https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/032293/general-configurations#ManagementVDOM

     

    This change alone did not cause the tunnel to go down. However, after rebooting the device in this state, the IPSec tunnel went down. When I switched the management VDOM back to the original VDOM where the tunnel resides—using the same method—the tunnel came back up.

     

    I did not move the interface from its current VDOM to another VDOM. Instead, I designated a different VDOM—one that does not contain the interface—as the management VDOM, and removed the management role from the VDOM where the interface actually resides.

    funkylicious
    SuperUser
    funkylicious
    SuperUser
    September 13, 2025

    in theory, change in management vdom should not have impact in the VDOM for IPsec as long as the interface IP ( IPsec IP remote/local remain the same ) / route ( a route for reaching the remote GW is valid and installed in RIB [ get router info routing-table details IP ] ) / firewall rules are in place and correct ( if the management interface is part of the IPsec config , in any of the previous mentioned , could be a factor of why it remains down since it's not used anymore/down ) .

     

    if not, i would say that it's a coincidence and would recommend doing a debug of the down state of the IPsec tunnel as described here, https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPN-tunnels/ta-p/195955 

    "jack of all trades, master of none"
      Terms & ConditionsAccessibility statement