Created on 08-14-2024 11:18 AM Edited on 01-22-2025 01:25 AM By Jean-Philippe_P
Description | This article describes an issue with IPsec VPN Tunnel Phase 2 instability on the NP6xlite platform. |
Scope | FortiGate. |
Solution |
Firmware:
Troubleshooting:
Perform np6xlite debugging:
diagnose npu np6xlite dce DROP_IPSEC0_ENGINB0:0000000000000683[80] DROP_IPSEC0_ENGINB1:0000000000000002[81]
IKE debugging (shown invalid ESP 4 (replay) SPI from the tunnel):
diagnose vpn ike log filter name "XXXX" ike V=root:0:XXXX: invalid ESP 4 (replay) SPI 3fe65c76 seq 00000000:00a02e94 7 Y.Y.Y.Y->Z.Z.Z.Z:0
Workaround:
config vpn ipsec phase2-interface edit "XXXX" set replay disable end diagnose vpn ike gateway filter name "XXXX" diagnose vpn ike gateway flush |