FortiOS 7.4.2 Bug Causes IPsec VPN Tunnel Phase 2 Instability

[andybarker]

I have had many site-to-site IPsec tunnels working fine for several years until I upgraded to FortiOS 7.4.2. Shortly afterward, my tunnels began dropping connections on random Phase 2 connections. I have had to bring down the phases or entire tunnel to get traffic flowing again many times. I opened a ticket with Fortinet and had three technicians working with me at various times but none found a solution.

I finally downgraded to 7.4.1 and all my problems went away. There is obviously a bug in 7.4.2 and I hope Fortinet finds and acknowledges it and fixes it for the next release.

[Kangming]

It sounds like you have another issue. When there are multiple phase 2, is it normal to only have the traffic of the first phase 2? Other phase 2 unable to pass traffic successfully? Or is there no phase 2 established? Is there some debug information? Can you share your configuration file?

FortiGate # diagnose debug application ike -1

FortiGate # diagnose debug enable

# diagnose sniffer packet any "host x.x.x.x" 4 0 l

[aguerriero]

TAC said 7.2.8 is supposed to be released on March 11th and addresses the 7.2.7 known issue with ipsec performance. That was the only reason we upgraded to 7.4.3 over 7.2.7 in the first place.

I will wait for that version.

[Kangming]

Could you share ticket id? Thanks.

[aguerriero]

9296054

[aguerriero]

TAC now says the 14th.

[ddiez]

Let's hope so

[kekarlsen]

It seems that we are experiencing the same after test upgrading a couple of FortiGates from 7.2.X to 7.4.x .

We have multiple IPSec dialup connections to our HQ from remote FortiGates, after upgrading to 7.4.x only the first tunnel gets established with Phase2. They are behind NAT and connecting to our HQ IPSec interface VPN by with tunnel-id differentiate them.

If I deactivate the first IPSec tunnel, then the next one automatically gets established. We use this with SDWAN for multiple carriers like to our HQ and finds this as a strange behaviour since we have had no issues with this setup for ages.

It does not seem that 7.4.4 fixed this issue for us either.

[aguerriero]

For dial ups they changed how the routing is done for some reason. Starting after 7.2.5. 

On all of your phase1s "set add-route disable"

On all of your phase2s "set route-overlap allow"

You either do both of those settings on all dial up phase1s and phase2s or you create specific phase2s that do not overlap. You only have to do this on the hub side of the dial up ipsec vpn. We have one hub with 1146 ipsec dial up tunnels and another with 200 and every single one of them cleared up after doing this.

[kekarlsen]

Thanks for the tip, but I don't think that will solve the issue as we are using BGP for IPSec routing and it is currently working with FOS 7.2.7 running at both Hub and several Spoke FortiGates.

I will try to open a ticket for this and see if I have any luck solving this issue.

[aguerriero]

These settings will not drop BGP learned routes. They stop the phase 1 from adding the SA to the routing table and also allow you to overlap SA's.

If you are doing 0.0.0.0 for source and destination in your phase 2 config only one tunnel will ever come up without those two settings.