FortiGate ADVPN Redundant tunnel traffic not working

[Reshans]

I have created ADVPN in one hub and two branches with two isp. my issue is one tunnel traffic all are working but when down active tunnel and all traffic going via this tunel but my issue is branch hub connectivity ok but branch to branch not ping.

Please see the below.

 

[funkylicious]

from the prntscrn that you have posted, i assume that 192.168.40.0/24 is the network in spoke2 which is unreachable from spoke1.

based on the last output of the routing monitor, the route towards that destination is using the internet link of ISP1/port1 whereas before it was using the ipsec tunnel intf SP1BKTU.

i would look into the ipsec/bgp config for hub/spokes and see where the issue might be.

you could also have a look at https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/820072/advpn-with-bgp-as-the... 

[Reshans]

same bgp setting but traffic still going via int site active tunnel working fine

[Reshans]

in sp2 showing this please help

SP2 # id=20085 trace_id=1240 func=print_pkt_detail line=5846 msg="vd-root:0 received a packet(proto=1, 192.168.20.2:1->192.168.40.1:2048) tun_id=2.2.2.1 from SP2TU2. type=8, code=0, id=1, seq=1383."
id=20085 trace_id=1240 func=init_ip_session_common line=6025 msg="allocate a new session-000023f2, tun_id=2.2.2.1"
id=20085 trace_id=1240 func=ip_route_input_slow line=2267 msg="reverse path check fail, drop"
id=20085 trace_id=1240 func=ip_session_handle_no_dst line=6111 msg="trace"
id=20085 trace_id=1241 func=print_pkt_detail line=5846 msg="vd-root:0 received a packet(proto=1, 192.168.20.2:1->192.168.40.1:2048) tun_id=2.2.2.1 from SP2TU2. type=8, code=0, id=1, seq=1384."
id=20085 trace_id=1241 func=init_ip_session_common line=6025 msg="allocate a new session-000023f4, tun_id=2.2.2.1"
id=20085 trace_id=1241 func=ip_route_input_slow line=2267 msg="reverse path check fail, drop"
id=20085 trace_id=1241 func=ip_session_handle_no_dst line=6111 msg="trace"
id=20085 trace_id=1242 func=print_pkt_detail line=5846 msg="vd-root:0 received a packet(proto=1, 192.168.20.2:1->192.168.40.1:2048) tun_id=2.2.2.1 from SP2TU2. type=8, code=0, id=1, seq=1385."
id=20085 trace_id=1242 func=init_ip_session_common line=6025 msg="allocate a new session-000023f7, tun_id=2.2.2.1"
id=20085 trace_id=1242 func=ip_route_input_slow line=2267 msg="reverse path check fail, drop"
id=20085 trace_id=1242 func=ip_session_handle_no_dst line=6111 msg="trace"

[funkylicious]

according to the logs, traffic is entering from interface SP2TU2 but gets dropped due to RPF, meaning a better route is installed in RIB than the one which traffic tries to enter.

i would check the routing table and see if or why a route for that ipsec tunnel/BGP peer is not installed/preferred and also the ECMP settings for BGP.