Tunnel IPSEC in FortiGate

Hi @unknown1020 

Please run the IKE debug command while the issue is happening and check the output:

# diagnose debug reset

# diagnose vpn ike log-filter dst-addr4 <Remote_Peer_IP>

# diagnose debug application ike -1

# diagnose debug console timestamp enable

# diagnose debug enable

To disable :

# diagnose debug disable

# diagnose debug reset

For more details follow the KB step-by-step - > https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Troubleshooting-IPsec-Site-to-Site-Tunnel/ta-p/195672

Best regards,

Erlin

Hello, kindly make sure the below options are configured to make sure tunnel remains up:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-IPSec-auto-negotiate-and-keepalive/ta-p/189536

Hello @unknown1020 

Also check Dead Peer Detection setting on both sides. 

Make sure it is set to 'On Demand' 

https://community.fortinet.com/t5/FortiClient/Technical-Tip-Configuring-DPD-dead-peer-detection-on-IPsec-VPN/ta-p/192616

Regards,

Varun

Do a continuous ping to the remote IP address to make sure that it is remaining up, and also change the mode to aggressive.

config vpn ipsec phase1-interface
edit <name>
set mode [aggressive|main]

Article Reference:

---------------------------------

https://docs.fortinet.com/document/fortigate/7.0.1/cli-reference/368620/config-vpn-ipsec-phase1-interface

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Differences-between-Aggressive-and-Main-mode-in/ta-p/196313

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPN-Phase-1-Process-Aggressive-Mode/ta-p/191185