Client Services (RDP, authentication) not Working Across VPN Tunnel

[RRatBB]

We have a remote site with a primary connection to internal networks via MPLS/BGP. Everything works.

When MPLS goes down, we have a backup ipsec VPN tunnel (OSPF) that comes up after about 90 seconds.

In testing, I have a continuous ping running against a client machine at the remote site. Pings timeout when MPLS goes down, and then replies resume when VPN comes up.

Traceroute before and after shows that routing is changed from MPLS path to VPN path.

So everything looks good from routing and ICMP perspective.

However, after the site comes up on VPN, I am unable to use our management tool (ManageEngine) to manage the remote machines. ManageEngine no longer sees the machine agents and displays them as offline. I cannot use the remote control tool, and I cannot use the remote command line tool.

Also, I cannot RDP to the remote machines either by hostname or IP address.

Finally, I can no longer log into the remote fortigate firewall with my domain credentials, presumably because the firewall can no longer communicate with our FortiAuthenticator.

Opened ticket with Fortinet support. Based on debugs, they are seeing traffic flow between me and the remote site. They are adamant that routing and firewall policies are not the problem. Logs indicate a client-rst when I try to RDP, and Fortinet says the problem is with our endpoints. Which ... just does not make sense to me. First of all, firewall is disabled on the client machines. Secondly, it's the same source IP, it's just coming across a different WAN path.

And finally, how would an "endpoint" problem affect both PCs and my ability to log in to the Fortigate?

I am at a loss. Hoping someone has seen something like this before. Thanks.

BTW, this is not happening at other sites with same topology (primary MPLS, secondary VPN).

[funkylicious]

have you tried tweaking the MTU in either the IPsec interface and/or the fw policy ?

doing a sniffer/debug on the traffic at the remote site, you can see/confirm that it's hitting the correct policy and interfaces for in/out traffic ?

[RRatBB]

Thanks for the suggestions.  I will test/verify next maintenance window. 

[zeninmo2]

If you cannot wireshark, try a ping <destination> -f -l 1492. If that is indeed the issue, they will need to lower the MTU on their machines. The amount depends on your VPN settings, 90 is probably a safe bet.