IPSEC DOWN UNTIL REBOOT

[ASPCORP]

We're having some issues with our IPSEC VPN

we have a 90D at our HQ and a 30D at our branch 

At times we notice that the VPN status is "UP" but we're unable to communicate.

After a reboot of both device everything is good again ...

what could cause this ?

[MikePruett]

Have you done any troubleshooting during the down time?

Try doing a packet capture of connection attempts across the tunnel when it isn't flowing traffic. See what happens there. That should give you a pretty good start as to where to look for more information.

[bommi]

Which version of FortiOS are you running on your FortiGates?

I had the same issue after an upgrade to 5.4.2 on an FortiGate 1000D Cluster.

[ASPCORP]

Yes What we notice is that we're unable to bring down the vpn no matter how many times we click bring down What we have to do is disable the interface and then it's down Once we bring it up we still can't get any connection until a reboot We've not tried doing an upgrade our current version is 5.2 (90D) 5.2.5 (30D)

[ede_pfau]

The hint for using blackhole routes is valuable. Search the forums for 'blackhole', you should find my ready-to-use script in insert bh routes for all private address ranges.

The point here is: these bh routes have the highest priority, that is, the highest cost. So they won't be used if there is a better route, the one across the VPN tunnel. When the tunnel goes down, it's route is deleted and all traffic follows the bh route into Nirvana. Thus, no sessions are opened and the VPN can be re-negotiated immediately.

The real underlying problem with your VPN is that the SA expires without prior re-negotiation. Look into the  'auto-rekey' and 'auto-negotiate' options in the docs and then in your config. You should also set up Dead Gateway Detection, i.e. a ping server, to inform the FGT immediately when the tunnel goes down.