|
Symptoms:
- Routes through the VPN tunnel become 'inactive' even though the tunnel's status is 'up', causing traffic failure.
- Tunnel diagnostic commands show 'dpd failure', but the tunnel is not down
Working scenario:
get router info routing-table database
S *> 0.0.0.0/0 [10/0] via IPSec tunnel 10.0.0.1, [1/0] <----- Route is active.
diagnose vpn tunnel list
name=IPSec ver=2 serial=1 10.56.6.245:4500->10.10.88.247:4500 nexthop=10.56.6.241 tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=1500 weight=1
bound_if=3 real_if=3 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=1 overlay_id=0
proxyid_num=1 child_num=0 refcnt=5 ilast=38 olast=0 ad=/0
stat: rxp=49592 txp=51122 rxb=4165728 txb=4294248
dpd: mode=on-idle on=1 status=ok idle=10000ms retry=3 count=3 seqno=1026
Non-working scenario:
get router info routing-table database
S > 0.0.0.0/0 [10/0] via IPSec tunnel 10.0.0.1 inactive, [1/0] <----- Route listed as inactive.
diagnose vpn tunnel list
name=IPSec ver=2 serial=1 10.56.6.245:4500->10.10.88.246:4500 nexthop=10.56.6.241 tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=1500 weight=1
bound_if=3 real_if=3 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=1 overlay_id=0
proxyid_num=1 child_num=0 refcnt=5 ilast=0 olast=36 ad=/0
stat: rxp=1198 txp=0 rxb=100632 txb=0
dpd: mode=on-idle on=1 status=fail idle=10000ms retry=3 count=0 seqno=1026
The issue has multiple possible observed triggers, including changing tunnel configuration and HA failover events.
Workaround:
Rebooting the FortiGate restores VPN functionality, but the issue may occur again. Disabling DPD in the tunnel configuration does not work around this issue.
Solution:
The issue is resolved in v7.4.9 and scheduled for resolution in the upcoming v7.6.5. See Issue ID 1180987 in FortiOS v7.4.9 Release Notes | Resolved Issues
The fix optimizes the DPD status check and update process to prevent inactive route behavior.
|
