Troubleshooting Tip: Security fabric connection failing over IPsec tunnel

[Raghu_Kumar]

Description	This article describes an issue where a security fabric connection or gets stuck in the 'connecting' state fails over IPsec tunnel.
Scope	FortiGate, all firmware.
Solution	Follow these troubleshooting steps: Make sure the tunnel is up and running with traffic on both sides of the tunnels (Head Office and Branch). Try to connect the upstream FortiGate with a loop-back IP. It should show a 'connecting' state, but never 'connected'. Make sure the IP addresses are configured on the VPN interface. Example: The following topology shows a downstream FortiGate (Branch) connected to the root FortiGate (HQ) over IPsec VPN to join the Security Fabric: Configure the IPsec VPN interface IP address which will be used to form the Security Fabric. Go to Network - > Interfaces. Edit the Tunnel in question. Set the Role to LAN. Set the IP/Network Mask to 10.10.10.1/255.255.255.255. Set the Remote IP/Network Mask to 10.10.10.3/255.255.255.0. Make sure that phase2 selectors allow the source and destination IP addresses. If the issue still surfaces, test the fabric connectivity using a sniffer: diagnose sniffer packet any “port 8013” 6 0 l Note: By default,  Port 8013 (set upstream-port 8013) is the port used for security fabric syncing. There should be no doubt on adding remote IP even in the case of dial-up IPsec VPN. Configuring IP addresses is still possible on VPN interfaces for dial-up VPN, similar to ADVPN, which is a dial-up VPN too. This is also valid for a site-to-site IPsec VPN. Related article:  Troubleshooting Tip: Troubleshooting Security Fabric Issues