|
Assuming ADVPN with BGP is implemented using the following documents:
Technical Tip: ADVPN with BGP as the routing protocol
ADVPN with BGP as the routing protocol
After the successful implementation of the configuration, shortcut tunnels will be up on one spoke but not on the other spoke. To find the cause of the issue, take IKE debugs on a spoke FortiGate device using the following CLI commands:
diagnose debug disable
diagnose debug reset
diagnose debug application ike -1
Debug messages will be on for 30 minutes.
diagnose debug console timestamp enable
diagnose debug enable
A similar error might be observed as follows on the output generated:
2024-08-08 10:27:27.413830 ike 0:advpn-spoke55-2: adding new dynamic tunnel for x.x.x.x:500
2024-08-08 10:27:27.413849 ike 0:advpn-spoke55-2: could not create dialup name advpn-spoke55-2_0, too long
2024-08-08 10:27:27.413877 ike 0:advpn-spoke55-2:956814: schedule delete of IKE SA 717cf449d4e288af/a87ca51e250c60dc
2024-08-08 10:27:27.413909 ike 0:advpn-spoke55-2:956814: scheduled delete of IKE SA 717cf449d4e288af/a87ca51e250c60dc
2024-08-08 10:27:27.413982 ike 0:advpn-spoke55-2: connection expiring due to phase1 down
2024-08-08 10:27:27.414001 ike 0:advpn-spoke55-2: deleting
2024-08-08 10:27:27.414023 ike 0:advpn-spoke55-2: deleted
There is a limitation in the maximum number of characters available when configuring the Phase 1 Interface name parameters for an IPsec VPN tunnel on the FortiGate. The IPsec VPN interface name is limited to 15 characters.
In this example, the tunnel name was ‘advpn-spoke55-2’ (15 characters) on spoke. But when a shortcut tunnel is created, it renamed the child tunnel ‘advpn-spoke55-2_0’ (16 characters) and that is not permitted hence the shortcut tunnels will never be created.
For more info, refer to Technical Tip: IPsec VPN phase1 interface name characters limitation best practice about the limitation of 15 characters on the VPN tunnel name.
To resolve the issue, the tunnel name can be renamed, if possible, to something shorter using the following article:
Technical Tip: Rename an IPsec tunnel
If not, then tunnels need to be created again. Copying config from CLI would be a good way to create the tunnels. Make sure not to use the same remote gateway for two tunnels, it will throw an error.
|
