FGT fails to choose correct route (redundant VPN tunnels)

[lynx]

Hello, guys,

So, I ran into this weird issue. I have two redundant tunnels on FGT600E, running 6.0.8. Config of both tunnels is identical, only remote gateway setting differs. Static routes are configured with different distance, routes to primary tunnel have distance of 10, routes to secondary tunnel have distance of 20. The problem is that when primary tunnel goes down, Fortigate still uses the route and doesn't use secondary tunnel's routes, and no traffic is routed through secondary tunnel. And, of course, when packets come through the secondary tunnel from the other side, they get dropped because of reverse path check fail.  Anyone heard of a bug here? Any suggestions? I tried to play with priority as well, the result is the same. 

[tioeudes]

check this doc to see if its all compliant:

https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-ipsecvpn-52/Redundant_VPN_Config...

Regards,

tioeudes

[Fullmoon]

lynx wrote:

Hello, guys,

So, I ran into this weird issue. I have two redundant tunnels on FGT600E, running 6.0.8. Config of both tunnels is identical, only remote gateway setting differs. Static routes are configured with different distance, routes to primary tunnel have distance of 10, routes to secondary tunnel have distance of 20. The problem is that when primary tunnel goes down, Fortigate still uses the route and doesn't use secondary tunnel's routes, and no traffic is routed through secondary tunnel. And, of course, when packets come through the secondary tunnel from the other side, they get dropped because of reverse path check fail.  Anyone heard of a bug here? Any suggestions? I tried to play with priority as well, the result is the same. 

how do you manage your 2 WAN links via SDWAN?

I have previous setup before HQ and Branch have 2 WAN links each. Both WAN links and VPN are member of SDWAN. SD WAN rules dictates my VPN traffic and internet access as well.

HQ |<ISP 1> IPSEC <ISP 1> |Branch

      |<ISP 2> IPSEC <ISP 2> |

Might to take a look on this link as well as reference.

https://kb.fortinet.com/kb/documentLink.do?externalID=FD41297

[lynx]

The Forti on our side has a single WAN1 link, there is no SD-WAN. So, WAN1 —— Primary Tunnel - - Other side’s WAN1 WAN1 — DR Tunnel — Other side’s WAN2 The routes look as following: Remote-end-local-subnet throught Primary tunnel with distance of 5 Remote-end-local-subnet through DR Tunnel with distance of 10 I’m puzzled why route through primary tunnel remains in action, when primary tunnel goes down...

[neonbit]

Check out your dead peer detection settings. From memory the default is 60 seconds (ie the VPN will stay active even when it's disconnected for 60 seconds before the routes get flushed and the new tunnel is used).

I'd recommend changing the DPD on the IPSEC VPNs on both sites. Below example will bring down the tunnel after 3 seconds.

config vpn ipsec phase-interface

edit vpn1

set dpd-retryinterval 1

set dpd-retrycount 3

end