Log/Counter For VPN Tunnel Down?

Forum|Forum|6 years ago
June 15, 2020
4 replies
8427 views

Hello all. A lot of remote access IPsec clients see random phase2 down messages. I was wondering how do i go about getting to the root cause of each phase2 down instance? I'd like to know if it was just due to DPD deciding FGT can't see the client for a period of time so it yanks the tunnel down or whatever else might cause it. Usually when DPD's the culprit, I see log messages about it prior to the phase2 down message. Can anyone point me in the right direction?

Best answer by emnoc

I don't think the logs will be useful on telling you why a phase2 went down. Not sure on what you striving to get at. So many factors can determine why a vpn is disconnected, imho

Ken Felix

sw2090

SuperUser

if you happen to have some FOrtinet logging device connected to your FGT you could look into vpn event log there.

Works fine here on our FortiManager.

[strike]If not you could only look at ipsec debug log on cli instead as I don't think that this is in standard event log.[/strike]

Correction: you see it on the FGT in the Log&Report menue under vpn events.

BK_LGWAuthor

New Member

Thank you for your reply. We do currently use FortiManager and that's where I can see that P2 message. However there are instances where the P2 goes down with no warning and no additional messages to explain why it happened. That's what I wanna get to the bottom of.

emnocAnswer

New Member

I don't think the logs will be useful on telling you why a phase2 went down. Not sure on what you striving to get at. So many factors can determine why a vpn is disconnected, imho

Ken Felix

Sign up

Login with SSO

Login to the community

Login with SSO