Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
andybarker
New Contributor II

FortiOS 7.4.2 Bug Causes IPsec VPN Tunnel Phase 2 Instability

I have had many site-to-site IPsec tunnels working fine for several years until I upgraded to FortiOS 7.4.2. Shortly afterward, my tunnels began dropping connections on random Phase 2 connections. I have had to bring down the phases or entire tunnel to get traffic flowing again many times. I opened a ticket with Fortinet and had three technicians working with me at various times but none found a solution.

 

I finally downgraded to 7.4.1 and all my problems went away. There is obviously a bug in 7.4.2 and I hope Fortinet finds and acknowledges it and fixes it for the next release.

76 REPLIES 76
Kangming

It sounds like you have another issue. When there are multiple phase 2, is it normal to only have the traffic of the first phase 2? Other phase 2 unable to pass traffic successfully? Or is there no phase 2 established? Is there some debug information? Can you share your configuration file?

FortiGate # diagnose debug application ike -1

FortiGate # diagnose debug enable


# diagnose sniffer packet any "host x.x.x.x" 4 0 l

Thanks

Kangming

aguerriero

TAC said 7.2.8 is supposed to be released on March 11th and addresses the 7.2.7 known issue with ipsec performance. That was the only reason we upgraded to 7.4.3 over 7.2.7 in the first place.

I will wait for that version.

Kangming

Could you share ticket id? Thanks.

Thanks

Kangming

aguerriero

9296054

aguerriero

TAC now says the 14th.

ddiez
New Contributor III

Let's hope so

KuC
KuC
kekarlsen

It seems that we are experiencing the same after test upgrading a couple of FortiGates from 7.2.X to 7.4.x .

 

We have multiple IPSec dialup connections to our HQ from remote FortiGates, after upgrading to 7.4.x only the first tunnel gets established with Phase2. They are behind NAT and connecting to our HQ IPSec interface VPN by with tunnel-id differentiate them.

 

If I deactivate the first IPSec tunnel, then the next one automatically gets established. We use this with SDWAN for multiple carriers like to our HQ and finds this as a strange behaviour since we have had no issues with this setup for ages.

 

It does not seem that 7.4.4 fixed this issue for us either.

aguerriero

For dial ups they changed how the routing is done for some reason. Starting after 7.2.5. 

On all of your phase1s "set add-route disable"

 

On all of your phase2s "set route-overlap allow"

You either do both of those settings on all dial up phase1s and phase2s or you create specific phase2s that do not overlap. You only have to do this on the hub side of the dial up ipsec vpn. We have one hub with 1146 ipsec dial up tunnels and another with 200 and every single one of them cleared up after doing this.

kekarlsen

Thanks for the tip, but I don't think that will solve the issue as we are using BGP for IPSec routing and it is currently working with FOS 7.2.7 running at both Hub and several Spoke FortiGates.

 

I will try to open a ticket for this and see if I have any luck solving this issue.

aguerriero

These settings will not drop BGP learned routes. They stop the phase 1 from adding the SA to the routing table and also allow you to overlap SA's.

If you are doing 0.0.0.0 for source and destination in your phase 2 config only one tunnel will ever come up without those two settings.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors