DDNS IPsec tunnel issue

[bvagadia]

Description	This article describes that when creating a tunnel between two FortiGates with one side its DDNS and the tunnel is not coming up.
Scope
Solution	When creating a tunnel between two FortiGates with one side as static IP and another side with DDNS IP. Run the below command and check the DDNS details. # config system ddn # show ful It will provide detailed info, now check the IP and it should be the same at the peer end. If IP's are not changing on the peer end that means the tunnel is still using the old IP, in that case, it is possible to enable DPD on-demand which can resolve the issue. Similar behavior can be observed when the tunnel is created using dial-up VPN between two FortiGates. On one side, it is possible to see that the tunnel is up with 0 incoming data and outgoing data will be non zero number,  on the remote side the tunnel will not be there, it is possible enable DPD on-demand which can resolve the issue. On-demand: Trigger Dead Peer Detection when IPsec traffic is sent but no reply is received from the peer. If the issue is not resolved then, open a case with TAC.