Skip to main content
marconet-22
marconet-22
Explorer II
July 6, 2026
Solved

Tunnel IPSec - Backup tunnel doesn't work

  • July 6, 2026
  • 3 replies
  • 69 views

Hi guys

FGT A with WAN 1 and WAN 2 interfaces with direct public address

FGT B with only WAN1

 

Created nr 2 tunnel ipsec

Tunnel 1 = FGT A WAN1    to    FGT B WAN

Tunnel 2 = FGT A WAN2    to    FGT B WAN

 

Created policy and static route with  administrative distance = 10 (Tunnel 1) and = 20 (Tunnel 2)

 

When tunnel 1 is DOWN I get strange output on routing interface.

Picture 1, static route works, I can reach LAN on FGT B

Picture 2, static route doesn’t work, I can’t reach LAN on FGT B. I get strange IP address on static route, 10.0.04 is not public IP of FGT B

 

Someone can suggest me any other checks?

What could it be?

Best answer by Toshi_Esumi

the 10.0.0.4 is just an ID to identify the second tunnel to the same gateway IP. So normal. And the problem is likely on the FGT B side. Was the primary tunnel down on the FGT-B and the static route to the primary disappeared from the routing-table?
If it looks ok at FGT-B, sniff packets with “any” for the interface at FGT-B to see where packets are coming from and going to.

Toshi

3 replies

Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
July 6, 2026

the 10.0.0.4 is just an ID to identify the second tunnel to the same gateway IP. So normal. And the problem is likely on the FGT B side. Was the primary tunnel down on the FGT-B and the static route to the primary disappeared from the routing-table?
If it looks ok at FGT-B, sniff packets with “any” for the interface at FGT-B to see where packets are coming from and going to.

Toshi

    sjoshi
    Staff
    sjoshi
    Staff
    July 7, 2026

    Hi ​@marconet-22 

     

    that is the tunnel ID you are seeing and is not cause for the issue.

     

    can you share below logs.

    diag sniff packet any ‘host x.x.x.x and icmp’ 4 0 l  » where x.x.x.x is the dst server ip

     

    take this capture on both fgt

     

    show routing table on FGTB too

    Thanks, Salon
      marconet-22
      marconet-22Author
      Explorer II
      July 7, 2026

      Thank you clarification about tunnel ID.

      I found the issue, when disable static route from FGT A ant tunnel is up then FGT B keep static route to tunnel 1 running.

      Test with disble of tunnel interface 1 and it works. Thank you guys.

      Terms & ConditionsAccessibility statement