HOB/SPOKES : VPN Dial-UP issue when spoke chang IP public

[adbgz]

Hi,
I had configured two VPNs/Site betwen HQ and sites (Hub/spoke) for resilience. One of two VPN is a Dialup over 4G and the other is an IPSEC site-to-site over Radio links (Fluidmesh). no loadbalanacing or SDWAN in this architecture.

So my problem is when the Spoke chang the IP Publics (VPN dialup over 4G), is creating a new phase 1/phase2 on Hub but the old phase1/phase2 still stuck on Hub so i get 2 connections dialup over the same vpn and is causing disconnecting on communication between 2 sites.

[ozkanaltas]

Hello @adbgz ,

Did you configure dpd (dead peer detection) on your ipsec configuration? DPD will detect peer status and change tunnel status to down for the old tunnel. 

[adbgz]

hi ozkanaltas,

I disabled it, because I need the tunnel stay up even if there is no traffic, because the equipment on the remote site only responds to commands launched from the HQ, so in most time there is no traffic in tunnel and i think if i applied dpd it will put the tunnel (the good one) down. 

[ozkanaltas]

Hi @adbgz ,

I think you can use dpd with on-demand mode. This mode is triggered if one peer sends a packet and the remote side does not respond to this package, dpd removes the tunnel. 

You can read this article about dpd on dial-up tunnels.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explanation-of-the-DPD-effect-on-a-dialup-...

[adbgz]

I think I'm going too fast, both tunnels are falling down when i applied dpd. That's what I was afraid of.

[istvanmarlok]

Hi @adbgz 

Did you find a solution for that? I have the same problem (when there is an IP change on 4G, the VPN dies). I tried some config change but nothing helped on that.

Thank you!