Hello everybody! Sorry for my english. I have 2 FG-100E. First - 7.04 firmware, second - 7.2.1. Each has a separate ISP and IPSEC VPN tunnel with the client. BGP is configured with the client via VTI on each FG-100. IPsec is terminated on loopback interfaces. When the tunnel down on the first FG-100, the traffic is switched via BGP to another FG-100 via another ISP.
I use asymmetric routing to save the application session when switching between FG-100.
The problem is that when traffic switches to second fortigate, AСK packets from the client are dropped. I don't watch them with a sniffer. BUT outgoing packets via tunnel reach the client. If the client re-create the session and sends SYN, then it starts working normally аnd I'm watching the incoming packets with a sniffer.
What was done:
1. Decrease the MTU on the tunnel and applied "set honor-df disable"
2. "set npu-offload disable" on phase 1
3. "set replay disable" on phase2
4. diagnose debug vpn tunnel list show encr/decr packet
5. "set anti-replay disable"
The client claims to send packets and the same problem exists with other clients.
The routing problem is excluded, because as soon as the client sends the SYN, I immediately see the packets and then everything works without loss.
Any idea what the problem is? Thanks