| Description |
This article explains how to resolve Site-to-Site IPsec VPN Intermittent Connection due to phase 2 mismatch on each local and remote site respectively. |
| Scope | FortiGate. |
| Solution |
To troubleshoot this, make sure there are enough phase 2 selectors on both local and remote sites. In addition, make sure IKE v2 is used instead of IKE v1.
Example of the problem:
In this example: There is a site-to-site IPsec VPN intermittent connection. There are only two Phase 2 selectors namely: Subnet A to Subnet C, and Subnet B to Subnet D. On Phase 2 debugging, phase 2 mismatch is seen in debug log.
Solution: Add two more phase 2 selectors, namely Subnet A to Subnet D and Subnet B to Subnet C, and change IPSec from IKE v1 to IKE v2.
Result: On phase 2 debugging, there is no more phase 2 mismatch and there is no more site-to-site IPsec VPN intermittent connection. |
