Skip to main content
YuChow
YuChow
New Member
November 2, 2023
Solved

Sovled:FEC not enabled for IPSEC(Update:Not works for dialup mode)

  • November 2, 2023
  • 6 replies
  • 2374 views

I already followed the official document to set ipsec phase1 and firewall policy,the server side still can't enable.But on the client side,fec enabled and working.System is fortigate 7.4.1 and licensed.

this is debug log:
3GBZykN2sRblDaS

 


and this is my config:
En7vbS4sUFIWt3V

 


TSxPkduGpVIc96t

 


But on the other side.the client,FEC is enabled and working.
This is debug log:
BM9tpmfoDlH8UeX

 


and this is my config:
tac4IEDNXmzP3Fb

 


Z2kM8frgjzTbtGV

 

Best answer by YuChow

Solved,dial up mode server will generate other one tunnel.Like name_0,name_1,etc.So need use "diagnose vpn tunnel fec name_0",not "diagnose vpn tunnel fec name" to check logs.

6 replies

hbac
Staff
hbac
Staff
November 2, 2023

Hi @YuChow, 

 

Can you provide the output of the following commands: 

 

diagnose vpn tunnel list

show vpn ipsec fec 

 

Regards, 

    YuChow
    YuChowAuthor
    New Member
    November 2, 2023

    @hbac 

    111.png

     

    122.png

     

    123.png

     

    321.png

     

    YuChow
    YuChowAuthor
    New Member
    November 2, 2023

    and my net packet loss always about 10%.

    YuChow
    YuChowAuthor
    New Member
    November 3, 2023

    I have test if use p2p with out NAT in a local test.FEC works.The FEC not works when one side behind NAT?

    1.png

     

    2.png

    YuChow
    YuChowAuthor
    New Member
    November 3, 2023

    Local test,using dialup mode.Server(NGF-1) side fec enabled=0,not works.

    3.png

     

    YuChow
    YuChowAuthorAnswer
    New Member
    November 4, 2023

    Solved,dial up mode server will generate other one tunnel.Like name_0,name_1,etc.So need use "diagnose vpn tunnel fec name_0",not "diagnose vpn tunnel fec name" to check logs.

    Terms & ConditionsAccessibility statement