Dialup L2TP IPSEC Dynamic routing after upgrage from 6.4.15 to 7.0.X

[Marthinnus]

Hello,

I am using an FG 80F with FortiOS version 6.4.15, connected to several Mikrotik devices via dial-up L2TP IPsec VPN. For dynamic routing, I use the RIP v2 protocol to enable communication between clients behind the devices and other remote networks.

When upgrading to FortiOS 7.0.X, I followed the manual steps to adjust L2TP: adding a static route to the 192.168.254.0/24 network for l2t.root and modifying the firewall policy. While the VPN connections are established, RIP does not function, and routes to remote Mikrotik networks are not created.

Below is my routing table in version 6.4.15 with the RIP protocol functioning correctly.

S* 0.0.0.0/0 [10/0] via 181.120.228.253, wan1
S 92.62.234.133/32 [15/0] via 92.62.234.133, VPN Mikrotik
S 178.255.168.3/32 [15/0] via 178.255.168.3, VPN Mikrotik
S 178.255.168.18/32 [15/0] via 178.255.168.18, VPN Mikrotik
S 178.255.168.25/32 [15/0] via 178.255.168.25, VPN Mikrotik
S 178.255.168.27/32 [15/0] via 178.255.168.27, VPN Mikrotik
S 178.255.168.28/32 [15/0] via 178.255.168.28, VPN Mikrotik
S 178.255.168.53/32 [15/0] via 178.255.168.53, VPN Mikrotik
S 178.255.168.115/32 [15/0] via 178.255.168.115, VPN Mikrotik
S 178.255.168.220/32 [15/0] via 178.255.168.220, VPN Mikrotik
C 181.120.228.252/30 is directly connected, wan1
R 192.168.3.0/24 [120/2] via 192.168.254.3, ppp2, 05:04:43
R 192.168.4.0/24 [120/2] via 192.168.254.4, ppp3, 01w0d14h
R 192.168.10.0/24 [120/2] via 192.168.254.10, ppp9, 5d23h25m
R 192.168.11.0/24 [120/2] via 192.168.254.2, ppp1, 2d23h07m
R 192.168.14.0/24 [120/2] via 192.168.254.5, ppp4, 00:58:04
R 192.168.15.0/24 [120/2] via 192.168.254.9, ppp8, 08:32:09
R 192.168.16.0/24 [120/2] via 192.168.254.6, ppp5, 1d12h40m
R 192.168.17.0/24 [120/2] via 192.168.254.8, ppp7, 09:41:22
R 192.168.18.0/24 [120/2] via 192.168.254.7, ppp6, 22:13:32
C 192.168.30.0/24 is directly connected, IPC VLAN
C 192.168.100.0/24 is directly connected, internal1
C 192.168.200.0/24 is directly connected, VOICE
C 192.168.254.1/32 is directly connected, ppp3
is directly connected, ppp9
is directly connected, ppp1
is directly connected, ppp5
is directly connected, ppp6
is directly connected, ppp7
is directly connected, ppp8
is directly connected, ppp2
is directly connected, ppp4
C 192.168.254.2/32 is directly connected, ppp1
C 192.168.254.3/32 is directly connected, ppp2
C 192.168.254.4/32 is directly connected, ppp3
C 192.168.254.5/32 is directly connected, ppp4
C 192.168.254.6/32 is directly connected, ppp5
C 192.168.254.7/32 is directly connected, ppp6
C 192.168.254.8/32 is directly connected, ppp7
C 192.168.254.9/32 is directly connected, ppp8
C 192.168.254.10/32 is directly connected, ppp9

I would greatly appreciate any ideas on what additional changes might have occurred after the upgrade and what areas I should focus on.

[ezhupa]

Hello,

If you have multiple VPN tunnels configured you might be matching the below article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dialup-IPSEC-issues-after-upgrading-v7-2-6...

Overlapping of routes caused VPN tunnels to flap and therefore not able to establish correctly.  Since the RIP routes are using the VPN to advertise their routes if the tunnel is not stable, routes will not get added. 
Otherwise, if the VPNs stay up but no traffic can pass through an IKE debug would be needed on the FGT to see how the negotiation is going. 

Hope this helps!

[Marthinnus]

Thank you very much for your answer! I will review the suggested solution and investigate further using IKE debugging if needed. I’ll definitely give it a try!