FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
tonylin1
Staff
Staff
Article Id 333246
Description This article describes an issue with IPsec VPN Tunnel Phase 2 instability on the NP6xlite platform.
Scope FortiGate.
Solution

Firmware:

  • Firmware version with impact.
    • v7.0.13 to v7.0.15.
    • v7.2.8.
    • v7.4.2 to v7.4.3.

 

  • Firmware version with fix.
    • v7.0.16.
    • v7.2.9.
    • v7.4.4.

 

Troubleshooting:

 

Perform np6xlite debugging:

 

diagnose npu np6xlite dce

DROP_IPSEC0_ENGINB0:0000000000000683[80] DROP_IPSEC0_ENGINB1:0000000000000002[81]

 

IKE debugging (shown invalid ESP 4 (replay) SPI from the tunnel):

 

diagnose vpn ike log filter name "XXXX"
diagnose debug application ike -1
diagnose debug enable

ike V=root:0:XXXX: invalid ESP 4 (replay) SPI 3fe65c76 seq 00000000:00a02e94 7 Y.Y.Y.Y->Z.Z.Z.Z:0
ike V=root:0:XXXX: invalid ESP 4 (replay) SPI 3fe65c76 seq 00000000:00a02eac 7 Y.Y.Y.Y->Z.Z.Z.Z:0
ike V=root:0:XXXX: invalid ESP 4 (replay) SPI 3fe65c76 seq 00000000:00a02eca 7 Y.Y.Y.Y->Z.Z.Z.Z:0
ike V=root:0:XXXX: invalid ESP 4 (replay) SPI 3fe65c76 seq 00000000:00a02ede 7 Y.Y.Y.Y->Z.Z.Z.Z:0

 

Workaround:

  • Execute 'set replay disable' on the phase2-interface on both sides of the IPsec VPN. The admin should use this as a workaround only; where Replay detection allows the FortiGate to check all IPsec packets to see if they have been received before. If any encrypted packets arrive out of order, the FortiGate discards them.

 

config vpn ipsec phase2-interface

    edit "XXXX"

        set replay disable

end

diagnose vpn ike gateway filter name "XXXX"

diagnose vpn ike gateway flush