Created on 06-21-2022 01:24 PM Edited on 06-22-2022 06:55 AM By Anonymous
Description |
This article discusses when FortiGate Session Life Support Protocol (FGSP) is enabled on FortiGate to sync sessions/IPsec tunnels up with another FortiGate, the FortiGate does not support being the initiator. It can only respond to IPsec negotiations. |
Scope | FortiGate |
Solution |
If the FortiGate is a responder, IKE/IPsec FGSP is incompatible with the concept of being an initiator.
Sample output:
# diag vpn ike gateway list name 'UAT_T1'
IKE Debug Output:
iiB_FW_PRA_SEDE_ACTIVE # ike 0:UAT_T1:UAT_T1: IPsec SA connect 7 41.79.124.142->34.252.112.166:0
This issue can be fixed by the configuration shown below:
# config system cluster-sync edit 1 set ipsec-tunnel-sync disable end |