vpn ssl subinterface stop working but internet is reachable
vpn ssl stop working but internet is reachable,
my topology is a sdwan connection to internet from two wan sub interfaces joined as sdwan members into a sdwan-zone, we are using the fortigate lower models and firmware are 7.4.0 and 7.2.4, internet connection are asymmetric, home-residential massive internet. SLA health check is active but ramdonly after a couple of days internet connection is up but vpn ssl sub interface is down, no echo-ping goes back and sniffer also doesn´t show anything, only remote solution is to reset port and after that sub interface goes up again. Following current sdwan config
edit 3
set interface "subinterface-primary-vpn"
set zone "sdwan-to-remote-hub"
next
edit 4
set interface "subinterface-backup-vpn"
set zone "sdwan-to-remote-hub"
next
...
edit "vpn-health-check"
set server <remote-looback-ip>
set interval 1000
set failtime 10
set recoverytime 10
set source <local-lan-ip-allowed>
set members <sub interfaces members 3 4>
next
…
config service
edit 3
set name "primary-internet-to-hub-concentrator"
set mode priority
set dst "all"
set src "all"
set health-check “vpn-health-check"
set priority-members 3
next
edit 4
set name "back-internet-to-hub-concentrator”
set mode priority
set dst "all"
set src "all"
set health-check “vpn-health-check"
set priority-members 4
next
….
Also consider a static default route pointing to this sdwan-zone so, that way server <remote-looback-ip> is reachable throughtout this zon
Greetings
