Azure site to site VPN drops when configuring HA

[TechMinerUK]

Hi all,

Sorry to bother however I am currently experiencing issues with a HA pair of FortiGate 50E running v6.2.12 build1319 (GA) firmware.

For some reason both units work flawlessly when they are in standalone mode with one unit active at each time with no issues with the site to site VPNs to Azure however when the units are installed in Active-Active or Active-Passive HA mode the site to site VPN is dropped and unable to be established again.

I have performed some diagnostics and I seem to be getting IKEV2 Phase 1 issues however I can't work out why this would be the case only when in HA as the settings input are the same of those on the Fortinet 6.2 cook book for setting up the Azure VPN.

I've made sure all the firewall rules and routes are present for traffic to flow and when in standalone can confirm I am able to access the Azure resources without issue.

Has anyone seen this issue before?

[TechMinerUK]

Hi there, thank you for persisting with me on this :)

I've run those commands and got the following back:

id=20085 trace_id=2 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=17, FGTIP:500->AzureIP:500) from local. "

id=20085 trace_id=2 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-0000003e, original direction"

id=20085 trace_id=3 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=17, FGTIP:500->AzureIP:500) from local. "

id=20085 trace_id=3 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-0000003e, original direction"

id=20085 trace_id=4 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=17, FGTIP:500->AzureIP:500) from local. "

id=20085 trace_id=4 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-0000003e, original direction"

id=20085 trace_id=5 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=17, FGTIP:500->AzureIP:500) from local. "

id=20085 trace_id=5 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-0000003e, original direction"

id=20085 trace_id=6 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=17, FGTIP:500->AzureIP:500) from local. "

id=20085 trace_id=6 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-0000003e, original direction"

id=20085 trace_id=7 func=print_pkt_detail line=5688 msg="vd-root:0 received a packet(proto=17, FGTIP:500->AzureIP:500) from local. "

id=20085 trace_id=7 func=resolve_ip_tuple_fast line=5768 msg="Find an existing session, id-0000003e, original direction"

[TechMinerUK · Accepted solution]

Hi everyone,

After some trials and tribulations I have finally resolved this issue.

During out of hours I spent some time swapping the firewalls over regularly to see if one of the units was defective, as it turned out one of the units even when in standalone mode could not seem to connect to the VPN after initation.

I attempted to factory reset the configuration, restore the working configuration from unit 1 to unit 2 but alas to no avail which led me to believe unit 2 had a fault and that the issue was not with the firmware or HA but rather unit 2 itself. I had even tried to re-load the firmware via the web GUI however the unit had to be manually rebooted in order to bring it back online leading me to believe their is a flashing issue somewhere.

As a last ditch effort today I borrowed a serial cable and formatted the firmware on the defective unit and re-loaded the latest firmware from FortiGate via TFTP and as luck would have it this seemed to resolve the issue.

As it stands the unit has now been installed for 4 hrs without issue or dropping of the VPN.