Skip to main content
dbah01
Explorer
June 7, 2025
Question

Second IPsec tunnel inactive with no activity

  • June 7, 2025
  • 2 replies
  • 1088 views

Hi All,

 

I have two custom IPSec tunnels setup on FortiGate from same local WAN interface connecting to remote site on different WAN interfaces. The first tunnel is up and running without issues, but the second tunnel shows inactive and show now activity under the events log. The tunnel interface behaves as if disabled but it's not. Any ideas where to start looking? Checked the setting again and again.

 

FortiGate firmware v7.0.15 build7480

Some details below:

 

get vpn ipsec tunnel summar

'HUB-V1' 197.245.xx.xx:0 selectors(total,up): 1/1 rx(pkt,err): 12247/0 tx(pkt,err): 16156/2

'HUB-V2' 169.255.xx.xx:0  selectors(total,up): 1/0 rx(pkt,err): 0/0 tx(pkt,err): 0/1 

 

FW # get vpn ipsec tunnel details

gateway
name: 'HUB-V2'
local-gateway: 217.91.xx.xx:0 (static)
remote-gateway: 169.255.xx.xx:0 (static)
dpd-link: off
mode: ike-v1
interface: 'ppp2' (25) vrf:0
rx packets: 0 bytes: 0 errors: 0
tx packets: 0 bytes: 0 errors: 1
dpd: on-demand/unnegotiated
selectors
name: 'HUB-V2'
auto-negotiate: enable
mode: tunnel
src: 0:192.168.10.0/255.255.255.128:0
dst: 0:192.168.0.0/255.255.255.0:0

2 replies

kcheng
Staff & Editor
Staff & Editor
June 7, 2025

Hi @dbah01 ,

 

Try checking the debug log for the specific tunnel:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPN-tunnels/ta-p/195955

 

Since you are on FortiOS 7.0.15, use the following commands to capture the IKE debug log:

diagnose vpn ike log filter dst-addr4 x.x.x.x 
diagnose debug application ike -1
diagnose debug console timestamp enable

diagnose debug enable

dbah01
dbah01Author
Explorer
June 7, 2025

Thanks for the support, issue was relating to below topic. I'm used to SonicWall and was not aware of this requirement.

 Technical Note: Log message 'ignoring request to establish IPsec SA, no policy configured'

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.