HOB/SPOKES : VPN Dial-UP issue when spoke chang IP public

[adbgz]

Hi,
I had configured two VPNs/Site betwen HQ and sites (Hub/spoke) for resilience. One of two VPN is a Dialup over 4G and the other is an IPSEC site-to-site over Radio links (Fluidmesh). no loadbalanacing or SDWAN in this architecture.

So my problem is when the Spoke chang the IP Publics (VPN dialup over 4G), is creating a new phase 1/phase2 on Hub but the old phase1/phase2 still stuck on Hub so i get 2 connections dialup over the same vpn and is causing disconnecting on communication between 2 sites.

[vermat51]

If I am not mistaken once the dialed up VPN dials up it should show as a Connected route and that is why since it is dynamic. I could be wrong. I would need to lab that out. I see this is your just putting the dial up VPN on the FGT vs individual machines https://omegle.onl/ .

[ozkanaltas]

Hello @adbgz ,

Did you configure dpd (dead peer detection) on your ipsec configuration? DPD will detect peer status and change tunnel status to down for the old tunnel. 

[adbgz]

hi ozkanaltas,

I disabled it, because I need the tunnel stay up even if there is no traffic, because the equipment on the remote site only responds to commands launched from the HQ, so in most time there is no traffic in tunnel and i think if i applied dpd it will put the tunnel (the good one) down. 

[ozkanaltas]

Hi @adbgz ,

I think you can use dpd with on-demand mode. This mode is triggered if one peer sends a packet and the remote side does not respond to this package, dpd removes the tunnel. 

You can read this article about dpd on dial-up tunnels.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explanation-of-the-DPD-effect-on-a-dialup-...

[adbgz]

I think I'm going too fast, both tunnels are falling down when i applied dpd. That's what I was afraid of.