No IPSec traffic cause of missing routing entry on 7.4.4 after hard disconnecting the "client" firewall.
additional info: main firewall is 200F - connecting client firewall is 60F (here i testet with 7.0 / 7.2 and 7.4 - so this is not important)
Following scenario on 7.4.4:
1) Connect "IPSec from DEV"
edit "IPSec from DEV"
set type ddns
set interface "*******"
set ike-version 2
set keylife 5400
set peertype any
set net-device disable
set proposal aes256-sha512 aes256-sha384
set localid "*********"
set auto-negotiate disable
set dpd on-idle <- also testet without this line
set npu-offload disable <- also testet without this line
set dhgrp 21 19 16
set nattraversal disable
set remotegw-ddns "***.**.*********.***"
set psksecret ENC *****==
next
2) get router info routing-table all
C 192.168.255.40/32 is directly connected, IPSec from DEV
S 192.168.255.41/32 [5/0] via IPSec from DEV tunnel 10.0.0.1, [1/0]
C 192.168.255.86/32 is directly connected, IPSec from PL
S 192.168.255.87/32 [5/0] via IPSec from PL tunnel 10.0.0.2, [1/0]
C 192.168.255.88/32 is directly connected, IPSec from BC
S 192.168.255.89/32 [5/0] via IPSec from BC tunnel ***.**.***.**, [1/0]
3) HARD POWER OFF "DEV" Firewall and wait 10-15 seconds
4) POWER ON "DEV" Firewall and wait till it connects (3-5 minutes)
5) get router info routing-table all
C 192.168.255.40/32 is directly connected, IPSec from DEV
C 192.168.255.86/32 is directly connected, IPSec from PL
S 192.168.255.87/32 [5/0] via IPSec from PL tunnel 10.0.0.2, [1/0]
C 192.168.255.88/32 is directly connected, IPSec from BC
S 192.168.255.89/32 [5/0] via IPSec from BC tunnel ***.**.***.**, [1/0]
The "192.168.255.41" line is missing (after a hard failure of the client firewall) an cannot even be added manually so the IPSec comes UP but since there is no route totally no traffic is flowing. 7.4.3 is building this route even after 10 "disconnects" - so something must be wrong with 7.4.4.
Can someone reproduce this and have the same issue?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi @Team-IT,
What do you mean "POWER ON "DEV" Firewall and wait till it connects"? You rebooted the firewall and reconnected to the VPN or you are using auto-negotiating?
Regards,
Created on 05-22-2024 10:53 AM Edited on 05-22-2024 10:55 AM
while "DEV (FG 60F) is ON and IPSec is connected just hard pull the power cord and replug it (like simulating a power outage) [there are other ways to reproduce this IPSec behavior; but this one works 100%]. "DEV" reboots and IPSec is automatically connecting again after a short time. And yes on "DEV" auto-negotiate is enabled:
edit "IPSec to MAIN"
set interface "*******"
set ike-version 2
set keylife 5400
set peertype any
set net-device disable
set proposal aes256-sha512 aes256-sha384
set localid "*******"
set dpd on-idle <- also tested without this line
set npu-offload disable <- also tested without this line
set dhgrp 21 19 16
set nattraversal disable
set remote-gw *****FIXED IP*****
set psksecret ENC *****==
next
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.