Dialup VPN failing with 5.2.7

[JohnAgora]

We've upgrade to 5.2.7 and we are having problems with out dialup VPNs.

We have some 60CX that make a dialup VPN with our central site (1500D). Both devices have 5.2.7.

We see the following info on debug on the remote device (60CX):

ike 0:VPN-4: could not locate phase1 configuration. sike 0:VPN-1:VPN-1: IPsec SA connect 35 1.1.1.9->1.2.1.4:0 ike 0:VPN-1: could not locate phase1 configuration. howike 0:VPN-2:VPN-2: IPsec SA connect 35 1.1.1.9->1.2.1.5:0

If I do the command "diagnose vpn ike restart" IKE restart and the VPNs get up.

Before we upgrade to 5.2.7 we didn't have the problem, all the VPNs start immediately.

Have anyone else experience that?

Is that a know bug?

Any ideas?

Thanks!

[ede_pfau]

Do you happen to use PPPoE on these FGTs? I've heard rumours of IPsec VPN not coming up on PPPoE interfaces with v5.2.7. Not in all cases, I imagine. Sorry, can't cite a doc for this.

[Jeff_FTNT]

It look some phase1 setting loss.You may check the setting

"ike 0:VPN-4: could not locate phase1 configuration"

[ShrewLWD]

Hmm, what makes this interesting is him saying 'If I do the command "diagnose vpn ike restart" IKE restart and the VPNs get up [emphasis mine]'

This sounds like they do come up, so they have the correct information. 

We have just started rolling out 5.2.7 on 60Cs and 60Ds, all doing Dial-up IPSEC VPN, and are not seeing this.

John, when are you finding them dropping?  Are you using these tunnels in some kind of demand-dial, where they only come up as needed?  Or are you rebooting the boxes occasionally, and not finding them come up after the reboot?

[JohnAgora]

Hello,

ShrewLWD wrote:

Hmm, what makes this interesting is him saying 'If I do the command "diagnose vpn ike restart" IKE restart and the VPNs get up [emphasis mine]'

This sounds like they do come up, so they have the correct information. 

We have just started rolling out 5.2.7 on 60Cs and 60Ds, all doing Dial-up IPSEC VPN, and are not seeing this.

John, when are you finding them dropping?  Are you using these tunnels in some kind of demand-dial, where they only come up as needed?  Or are you rebooting the boxes occasionally, and not finding them come up after the reboot?

The boxes occasionally have a reboot (I think that's when the fail occur, we have lots of boxes, it is hard to monitor all).

We do use PPPoE for the Internet access.

We plan to rollback to 5.2.4.

[mburgess]

Upgraded a 60C here with exactly the same problem. Failed IPSEC dialup VPN and also IPSEC tunnel to a 60D. Ran the command "diagnose vpn ike restart" and the dialup and tunnels work ok.

[davi_bittencourt]

JohnAgora wrote:

We've upgrade to 5.2.7 and we are having problems with out dialup VPNs.

We have some 60CX that make a dialup VPN with our central site (1500D). Both devices have 5.2.7.

We see the following info on debug on the remote device (60CX):

ike 0:VPN-4: could not locate phase1 configuration. sike 0:VPN-1:VPN-1: IPsec SA connect 35 1.1.1.9->1.2.1.4:0 ike 0:VPN-1: could not locate phase1 configuration. howike 0:VPN-2:VPN-2: IPsec SA connect 35 1.1.1.9->1.2.1.5:0

If I do the command "diagnose vpn ike restart" IKE restart and the VPNs get up.

Before we upgrade to 5.2.7 we didn't have the problem, all the VPNs start immediately.

Have anyone else experience that?

Is that a know bug?

Any ideas?

Thanks!

I had the same problem with VPN tunnel between 60c and 110c. In my case, the VPN interface has configured to use PPPoE mode. I opened a ticket with the fortinet and the support tell me that is a bug. The solution is upgrade the firmware to 5.4.0 or wait for 5.2.8 (last 2 weeks of july, 2016).   Support Fortinet:   "Dear Customer, Thank you for contacting the Fortinet Technical Assistance Center. My Name is ********** and I will be addressing your case. I did a research and indeed your issue is related to a known bug. Bug#0367491 - IPSec tunnel using wan1 interface in pppoe mode, cannot get back up after PPPoE disconnect and reconnect Bug is fixed on version 5.4.0 For version 5.2.x it is planned to be fixed on 5.2.8 which will be release during the first 2 weeks of July. Your solution will be to go for 5.4.0 which I do not recommend doing for now, or to wait for the 5.2.8 release on which a fix will be provided."

Admin: Post has been modified to remove the name of the engineer.  We ask that you do not post the names of individuals without their consent.