Fortigate 80F IPSec Tunnel to Cloud Hosted Servers Down

[dsluder]

I've been trying to get a IPSec tunnel from my Fortigate 80F to our cloud hosted servers. It will come up every once in a while but only stay up for a few hours. Ran the diagnose connection and these are the errors I get: (removed the VPN name and IP address info but checked both are correct).

It worked great for a while but I can't figure out what is causing those two errors.

2022-12-07 16:28:56.117964 ike 0:VPN:14172: sent IKE msg (RETRANSMIT_SA_INIT): 100.0.0.0:500->0.0.0.:500, len=400, vrf=0, id=ea6a7b66ed952355/0000000000000000
2022-12-07 16:29:00.127852 ike 0:VPN:VPN: IPsec SA connect 5 0.0.0.0->198.0.0.0:0
2022-12-07 16:29:00.127931 ike 0:VPN:VPN: using existing connection
2022-12-07 16:29:00.127954 ike 0:VPN:VPN:config found
2022-12-07 16:29:00.127975 ike 0:VPN: request is on the queue
2022-12-07 16:29:05.087800 ike 0:VPN:14172: negotiation timeout, deleting
2022-12-07 16:29:05.087957 ike 0:VPN: connection expiring due to phase1 down
2022-12-07 16:29:05.087984 ike 0:VPN: deleting
2022-12-07 16:29:05.088009 ike 0:VPN: deleted
2022-12-07 16:29:05.088030 ike 0:VPN: schedule auto-negotiate
2022-12-07 16:29:05.137845 ike 0:VPN:VPN: IPsec SA connect 5 100.000.000.000->198.00.0.00:0
2022-12-07 16:29:05.137895 ike 0:VPN:VPN: config found
2022-12-07 16:29:05.137952 ike 0:VPN: created connection: 0x8bc65d0 5 100.000.000.000->198.00.0.00:500.
2022-12-07 16:29:05.137987 ike 0:VPN: IPsec SA connect 5 100.0.0.0->198.0.0.0:500 negotiating
2022-12-07 16:29:05.138035 ike 0:VPN: no suitable IKE_SA, queuing CHILD_SA request and initiating IKE_SA negotiation

[JonathanTorian_FTNT]

The messages:

2022-12-07 16:28:56.117964 ike 0:VPN:14172: sent IKE msg (RETRANSMIT_SA_INIT): 100.0.0.0:500->0.0.0.:500, len=400, vrf=0, id=ea6a7b66ed952355/0000000000000000

2022-12-07 16:29:05.087800 ike 0:VPN:14172: negotiation timeout, deleting
2022-12-07 16:29:05.087957 ike 0:VPN: connection expiring due to phase1 down

Typically indicate that the remote side stopped responding to the FortiGate's attempt to re-negotiate the IPSec tunnel.  

If this was working before but no longer is, what changed?  Was a firmware update performed?  Was there a modification in the network?  Did your cloud hosted server switch providers?

Since you already know how to enable the debugs for the ike process, it would be best to keep that enabled and periodically check for when the issue is occurring so you can gather information that may uncover the cause of this issue.  However, based on what you have provided thus far, it just looks like the remote side stops responding.

I know this is not much but I hope this helps.  If you can provide anymore information, we can try to dig a little deeper.

[ede_pfau]

From the debug info, phase1 (IKE) is down when trying to re-negotiate phase2 (ipsec). That may be due to DPD setting, no auto-renegotiation or differing timeouts in phase1. I'd check that config closely.

[dsluder]

Finally got it up and running and they haven't went down since *knock on wood*.

Had the original 6.x firmware and instead of updating to the latest 7.x I did that after setting up the IPSec tunnels.

Now the following changes may not have been the fix, I changed a lot and it could have been the change that fixed the error just needed a few hours to refresh. But I changed the following settings on the IPSec tunnels:

- Auto discovery sender disabled

- Auto discovery receiver disabled

- Exchange interface IP disabled

- Dead Peer Detection On Demand

- I then changed the VPN Interface from Wan to the IPSec tunnel name, saved, then set it back to Wan and it worked

Honestly I think it was stuck on an old configuration and finally changing a few settings and swapping the interface back and forth cleared out whatever was causing the Phase 1 tunnel to be down finally started talking and came back up.