Troubleshooting Tip: Service Connection shows 'All service connections have issues' post SPA configuration

[RBA]

Description	This article describes how to verify and fix the 'All service connections have issues' error.
Scope	FortiSASE.
Solution	Post SPA configuration, Service Connection would show error 'All service connections have issues' as below: This usually points to misconfiguration. Configuration can be validated by rereferring this document: Configuring the FortiSASE security PoPs as the FortiGate hub's spokes. One of the scenarios is where Health Check would show down. Packet captures would show the Hub not responding to the health check probes sent from FortiSASE. 2025-02-27 15:31:18.118414 hub1 out 10.251.xx.xx -> 172.16.xx.xx: icmp: echo request 2025-02-27 15:31:18.619135 hub1 out 10.251.xx.xx -> 172.16.xx.xx: icmp: echo request 2025-02-27 15:31:19.119991 hub1 out 10.251.xx.xx -> 172.16.xx.xx: icmp: echo request Packet capture can be taken on the HUB FortiGate too to identify if HUB is receiving the traffic and replying back: diagnose sniff packet any 'host 10.251.xx.xx and host 172.16.xx.xx and icmp' 4 0 l The basic check would be to verify the destination IP if it exists on the Hub (if not it would be necessary to have a loopback interface with the IP assigned). The firewall policy should be validated to check if the traffic is allowed. Flow debugs can be enabled further on the Hub to debug the traffic and fix it accordingly: diagnose debug enable diagnose debug flow filter addr 172.16.xx.xx diagnose debug flow show function-name enable diagnose debug flow trace start 100 diagnose debug disable <----- To stop it.