Description | This article explains that link-monitor does not work with dial-up type IPsec VPN. |
Scope | FortiGate. |
Solution |
In dial-up type IPsec VPN, the routing table is not updated even if the link-monitor status is changed to dead as follows.
diagnose sys link-monitor status Link Monitor: LinkVPN, Status: dead, Server num(1), HA state: local(dead), shared(dead)
get router info routing-table all | grep VPN S 192.233.181.0/26 [5/0] is directly connected, VPN-A, [1/0]
Reason: This is expected behavior. It will not affect the routing table if the link-monitor is configured on a dial-up tunnel with the net-device disabled(default).
Workaround: If this dial-up tunnel has only one spoke, it must be set to a static tunnel. If not, it should use the static route with the gateway specified and BFD enabled.
Related article: |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.