FortiGate VPN IPSec Tx Error

[zoriax]

Hello,

Recently, I upgraded all my FortiGates from FortiOS 7.2.6 to 7.4.5. After several weeks with no issues, I took a closer look at my configuration and noticed an unusual increase in IPSec VPN errors.

Specifically, the TX error counter on the IPSec VPN interface has been steadily increasing on all FortiGates with a PPPoE WAN interface.

stat: rxp=6099751 txp=4612589 rxb=3619539840 txb=1263016689 rxe=0 txe=3928

I thoroughly reviewed my configuration and conducted several tests. While I can replicate the TX errors, they don’t appear to impact traffic or data transfer. Given this, I decided to open a support case. After several weeks of investigation, no specific issues related to FortiOS have been identified.

I’ve also attempted to adjust the MTU and TCP-MSS settings in my firewall policies, but these changes haven’t resolved the issue. I already tried to edit these values to lower size but nothing change.

Here’s the relevant part of my configuration:

config system interface
   edit wan
      set mtu-override enable
      set mtu 1492
   next
end

config firewall policy
   edit 1001
      set tcp-mss-sender 1380
      set tcp-mss-receiver 1380
      set auto-asic-offload disable
   next
end

I’m already familiar with some common causes of TX errors, such as:

• Attempting to send traffic when no IPSec SA has been negotiated.
• Attempting to send traffic when there is no route to the gateway IP.
• Attempting to send traffic on an IPSec SA that is dead/expired.
• Insufficient memory to add the IPSec header onto the outgoing packet.

I have double-checked these possible causes and haven’t identified any related traffic issues.

I would appreciate your assistance in understanding what might be causing these TX errors and the potential reasons behind them.

Thank you very much.

[AEK]

Hello Zoriax

I see txe about 0.15% of txp. I think this is not bad at all.

On the other hand, it can also be related to the WAN connection. So do you see any tx errors on the associated WAN interface?

Also on the remote side do you see any rx/tx error on the tunnel interface or on the associated WAN interface?

[zoriax]

Hello AEK,

Thanks for your response. The tx error is equals to 0 on WAN interface. Same on remote site, tx error is equals to 0. So it only increased on spoke.

The number is low because I cleared counter just before creating this post.