One of my customers is running an IPSEC tunnel between their FG and a vendor's system. I do not know what the remote side is running. Starting last week, the tunnel has been dropping for unknown reasons. Neither of us shows a reason in our logs. I haven't gotten beyond teir 1 on their end but that person chats with 2 or 3. It was a worthless call. Our side simply reports phase 2 down. It may come back up on its own within a few hours or it may stay down until one of us restarts it. After the phase 2 down message, there are no failure messages between there and the restart. I suspect Spectrum may be having issues and causing the drop but can't prove anything yet. All I have to do is hit bring up and it immediately comes back up. There's no issue to troubleshoot. But here's what I really need: Why doesn't the tunnel immediately try to come back up on its own? How do I get it to begin to renegotiate as soon as it detects it went down? I'm running 5.6.13.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello,
You need to set the auto negotiation in phase 2 to bring up the vpn connection automatically.
For your reference:
https://kb.fortinet.com/k...nk.do?externalID=12069
Thanks
After typing 'end' in that command set, I get the following:
node_check_object fail! for phase1name is empty.
Attribute 'phase1name' MUST be set.
Command fail. Return code -56
I haven't found exactly how I'm supposed to get the phase 1 name in this config.
If I do:
config vpn ipsec phase2
edit myPhase2Name
set phase1name myPhase1Name
I'm greeted by the following:
entry not found in datasource
value parse error before 'myPhase1Name'
Command fail. Return code -3
I'm assuming the phase 1 name is the same as the VPN name in the GUI.
you probably want to start with
config vpn ipsec phase2-interface
so add -interface
if you aren't using interface based VPNs try looking at using those, it is the default and works fine in almost all cases.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
227 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.