|
Symptoms:
- Routes through the VPN tunnel become 'inactive' even though the tunnel's status is 'up', causing traffic failure.
- Tunnel diagnostic commands show 'dpd failure', but the tunnel is not down.
Working scenario:
get router info routing-table database
S *> 0.0.0.0/0 [10/0] via IPSec tunnel 10.0.0.1, [1/0] <----- Route is active.
diagnose vpn tunnel list
name=IPSec ver=2 serial=1 10.56.6.245:4500->10.10.88.247:4500 nexthop=10.56.6.241 tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=1500 weight=1
bound_if=3 real_if=3 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=1 overlay_id=0
proxyid_num=1 child_num=0 refcnt=5 ilast=38 olast=0 ad=/0
stat: rxp=49592 txp=51122 rxb=4165728 txb=4294248
dpd: mode=on-idle on=1 status=ok idle=10000ms retry=3 count=3 seqno=1026
Non-working scenario:
get router info routing-table database
S > 0.0.0.0/0 [10/0] via IPSec tunnel 10.0.0.1 inactive, [1/0] <----- Route listed as inactive.
diagnose vpn tunnel list
name=IPSec ver=2 serial=1 10.56.6.245:4500->10.10.88.246:4500 nexthop=10.56.6.241 tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=1500 weight=1
bound_if=3 real_if=3 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=1 overlay_id=0
proxyid_num=1 child_num=0 refcnt=5 ilast=0 olast=36 ad=/0
stat: rxp=1198 txp=0 rxb=100632 txb=0
dpd: mode=on-idle on=1 status=fail idle=10000ms retry=3 count=0 seqno=1026
The issue has multiple possible observed triggers, including changing tunnel configuration and HA failover events.
Workaround:
Bringing the tunnel down and back up or rebooting the FortiGate temporarily restores VPN functionality, but the issue may reoccur. Disabling DPD in the tunnel configuration does not serve as a workaround.
Solution:
This issue has been resolved in:
v7.4.9 (available to download from the Fortinet support portal).
v7.6.5 (scheduled to be released in December 2025).
v8.0.0 (scheduled to be released in March 2026).
These timelines for firmware release are estimated and may be subject to change.
See Issue ID 1180987 in FortiOS v7.4.9 Release Notes | Resolved Issues.
The fix optimizes the DPD status check and update process to prevent inactive route behavior.
Related articles:
Technical Tip: Configuring DPD (dead peer detection) on IPsec VPN
Technical Tip: Explanation of IPsec VPN DPD Options and On-Idle tunnel flushing process
Technical Tip: Understanding and Troubleshooting IPSec VPN Disconnection Issues
|
