Fortinet FGT61F (v7.4.4 build2662) has 2 IPSEC tunnels but only 1 remains up at a time

[abdussalam]

Fortinet FGT61F has 2 IPSEC tunnels but only 1 remains up at a time

I have 2 IPSEC tunnels towards a destination, one each over 2 WAN links towards same destination.

But have been facing issue that only one IPSEC tunnel remains up at a time.

Once I enable both the IPSEC tunnels, then they both start flapping.

So I am forced to disable one IPSEC tunnel, only after which the other IPSEC tunnel remains UP and stable.

Will share more details if needed.

[kaman]

Hi abdussalam,

-If one ISP goes down, automatically the traffic should failover to the secondary tunnel.

-You can refer to the below commands and in this case, one tunnel will always be up.

config vpn ipsec phase1-interface
edit <Backup-phase1-name>
set monitor <primary's phase1-name>
end

Please refer to the below document for more information:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-Site-to-Site-tunnel-monitor/ta-p...

If you want both IPsec tunnels will be up always, then it is necessary to apply identical distances but a higher priority to the secondary static route.

You can refer to the below document for more information:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Redundant-IPSEC-Tunnel-using-single-WAN-co...

You can run the below sniffer commands to check the outgoing tunnel interface:

diagnose sniffer packet any ' host x.x.x.x ' 4 0 l ------- where x.x.x.x is the destination IP

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards
Aman

[abdussalam]

Can't we configure both the tunnels to be active at a time so that we can forward traffic over it based on IPSLA.

Our setup is similar to this. Infact we have such setup in other locations too and working fine, but only in one such location we are facing this issue.

i.e If I try to enable both at the same time, they start flapping....while if I disable one of them, then the other remains up and stable..

[kaman]

Hi abdussalam,

As mentioned above, if you want both IPsec tunnels will be up always, then it is necessary to apply identical distances but a higher priority to the secondary route.

Set both distances to be equal and assign a higher priority to the secondary tunnel in the static routing configuration.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Redundant-IPSEC-Tunnel-using-single-WAN-co...

Once both tunnels are enabled, execute the sniffer commands to verify whether the outgoing traffic is routed through the primary tunnel. Additionally, check if the reverse traffic is being received through the primary tunnel or the secondary tunnel.

diagnose sniffer packet any ' host x.x.x.x ' 4 0 l ------- where x.x.x.x is the destination IP

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards
Aman

[dingjerry_FTNT]

Hi @abdussalam ,

Please share your VPN configuration.  Also, what is the remote peer?  Is it a third-party product?  Does it have 2 VPN tunnels as well?

[Yurisk]

I'd look at the routing table of FGT and especially at the resolving of the remote peer IPs. My guess would be that the recursive resolving is involved and the destination overlap occurs.