Skip to main content
James_G
James_G
New Member
January 8, 2020
Question

IPSEC VPN failure after 6.2.3 update

  • January 8, 2020
  • 2 replies
  • 10579 views

Had an issue with the 6.2.2 to 6.2.3 update, possibly an undocumented change in default behavior. Traffic over IPSEC VPN was failing, after seeing that a new option had appeared in GUI for "Device Creation" I investigated further. I set the following under the phase1 interface and everything kicked in

 

set net-device disable

 

I don't understand fully, but thought I would share as it fixed my immediate issue :)

    2 replies

    Jirka1
    Jirka1
    Explorer II
    January 8, 2020

    Hi James,

     

    here is a very detailed explanation:  https://kb.fortinet.com/k....do?externalID=FD41498 (link at the bottom of the page). It also surprised me :)

     

    Jirka

    James_G
    James_GAuthor
    New Member
    January 8, 2020
    Detailed yes, but it reinforces my thought that the default must have changed to enabled between 6.2.2 and 6.2.3
    Jirka1
    Jirka1
    Explorer II
    January 8, 2020

    That's weird.. I upgraded the two boxes from 6.2.2 and 6.2.3 and the settings remained the same.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    January 8, 2020

    That "net-device" setting was introduced (or forced to be introduced) with 5.6, if I remember correctly. With previous versions, FTNT TAC said "it's always been enabled". But due to the 5.6's structural change, without explicit "disabled", establishment of dialup/dynamic IPsec and tearing down would be slower than policy based IPsec, which doesn't require any dynamic VPN interface creation.

    You can see the explanation at below KB, and more in detail in the pdf presentation doc linked at the bottom of the KB.

    https://kb.fortinet.com/kb/documentLink.do?externalID=FD41498

     

    I noticed "set net-device enable" even for my static IPSec when I upgraded my test 60E to 6.2.3. Since it's static, no reason to be "enabled". But they must have decided to make everything "enabled" since it's safer. I don't know why yours don't work but must be something to do with the type of your IPSec and the previous config for "set tunnel-search { selectors | nexthop }" setting. I recommend you open a ticket to clarify why "enable" broke your IPSec.

     

    I was to open a ticket to ask why they decided to enable it even for "static" IPsec. But since we decided not to go to 6.2.3, instead going to 6.0.8, I lost my reason to ask them at this time.

    James_G
    James_GAuthor
    New Member
    January 9, 2020

    TAC call raised

     

    I use FEC on this tunnel, I wonder if this is any way linked. Will update when I know more.

    James_G
    James_GAuthor
    New Member
    January 10, 2020

    TAC are not helpful just yet, they responded that the set net-device should be set to "disable", and if I have further issues with it set to disable then get some trace results. Totally missing the point that the default has changed from disable to enable at 6.2.3, without any reference in notes.

    Terms & ConditionsAccessibility statement