Created on 06-21-2022 01:24 PM Edited on 06-22-2022 06:55 AM By Anonymous
Description |
This article discusses when FortiGate Session Life Support Protocol (FGSP) is enabled on FortiGate to sync sessions/IPsec tunnels up with another FortiGate, the FortiGate does not support being the initiator. It can only respond to IPsec negotiations. |
Scope | FortiGate |
Solution |
If the FortiGate is a responder, IKE/IPsec FGSP is incompatible with the concept of being an initiator.
Sample output:
# diag vpn ike gateway list name 'UAT_T1'
IKE Debug Output:
iiB_FW_PRA_SEDE_ACTIVE # ike 0:UAT_T1:UAT_T1: IPsec SA connect 7 41.79.124.142->34.252.112.166:0
This issue can be fixed by the configuration shown below:
# config system cluster-sync edit 1 set ipsec-tunnel-sync disable end |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.