FortiOS 7.4.2 Bug Causes IPsec VPN Tunnel Phase 2 Instability

[andybarker]

I have had many site-to-site IPsec tunnels working fine for several years until I upgraded to FortiOS 7.4.2. Shortly afterward, my tunnels began dropping connections on random Phase 2 connections. I have had to bring down the phases or entire tunnel to get traffic flowing again many times. I opened a ticket with Fortinet and had three technicians working with me at various times but none found a solution.

I finally downgraded to 7.4.1 and all my problems went away. There is obviously a bug in 7.4.2 and I hope Fortinet finds and acknowledges it and fixes it for the next release.

[computos]

Hi, in my company we upgraded to fortios 7.4.3 and have the same situation. Do you have any news of this incident ? Thks

[People_First]

Currently our enterprise is using 7.4.3 across all of our gates they range from 60fs to 200fs we use advpn tunnels to communicate to all branch site.  We were definitely experiencing tunnel instability across the board. After working with support over many sessions the root of the issue seems to be BGP Flapping/becoming unreachable that seems to poison the routing table. One of the Fixes that seems to be working was to set phase one on any locations having the issue to

set npu-offload disable

Our tech also suggested disabling the short cut routes. (we have not done this yet)  if the issue continues.

as always I suggest you discuss any advice with support before trying changes and if possible not on a production environment or during production hours.

[BillH_FTNT]

Hi @People_First 

1. set npu-offload disable : it will not offload on NPU however all packets will be processed by CPU. If your traffic is not much, then it is quite a good option.

2. You can check feedback from Kangmin in this thread about disabling the replay in phase 2 of IPsec by commanding "set replay disable." Remember "diagnose VPN like gateway flush." 

3. You can check something more in my post https://community.fortinet.com/t5/Support-Forum/FortiOS-7-4-2-Bug-Causes-IPsec-VPN-Tunnel-Phase-2-In...

HTH

Bill

[BillH_FTNT]

Hi @computos 

1. If you have same situation, you can try the solution from Kangming post here : https://community.fortinet.com/t5/Support-Forum/FortiOS-7-4-2-Bug-Causes-IPsec-VPN-Tunnel-Phase-2-In...

2. Some information you can get from my post here:

https://community.fortinet.com/t5/Support-Forum/FortiOS-7-4-2-Bug-Causes-IPsec-VPN-Tunnel-Phase-2-In...

HTH

Bill

[aguerriero]

This doesn't just affect NP6 lite. I have an 1100E that is constantly dropping phase 2 connections on dozens of tunnels. If I only ever create 1 phase 2 SA it will work just fine. Any more than 2 and the problem gets worse and worse.

[BillH_FTNT]

Hi @aguerriero 

If the post above doesn't help you so, I think you should contact TAC for support.
Bill

[aguerriero]

I did. I am tracking a bunch of  threads that have this major problem. Alot of chatter on the web keeps saying TAC keeps trying to push this back as some kind of configuration issue... but there are way to many people complaining about it.

[BillH_FTNT]

Some people on the web have replay issues. And there are already workouts for that, so I think it should be okay for most users. For your case, if it is not a replay issue after you check, you can ask TAC for support. That is an easy method to do. Then TAC will check, and even the engineering team can support.

[andybarker]

I agree. With all the people who are complaining, it has to be a bug and not a configuration issue. As I said before, I had no issues with VPN performance before 7.4.2 was installed. Immediately after, I had issues.

[Kangming]

Can you share the complaints in these forums or on the Internet? We may be able to find some clues or confirm the problem, thank you