Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
James_G
Contributor III

IPSEC VPN failure after 6.2.3 update

Had an issue with the 6.2.2 to 6.2.3 update, possibly an undocumented change in default behavior. Traffic over IPSEC VPN was failing, after seeing that a new option had appeared in GUI for "Device Creation" I investigated further. I set the following under the phase1 interface and everything kicked in

 

set net-device disable

 

I don't understand fully, but thought I would share as it fixed my immediate issue :)

8 REPLIES 8
Jirka1
Contributor III

Hi James,

 

here is a very detailed explanation:  https://kb.fortinet.com/k....do?externalID=FD41498 (link at the bottom of the page). It also surprised me :)

 

Jirka

James_G
Contributor III

Detailed yes, but it reinforces my thought that the default must have changed to enabled between 6.2.2 and 6.2.3
Jirka1
Contributor III

That's weird.. I upgraded the two boxes from 6.2.2 and 6.2.3 and the settings remained the same.

James_G
Contributor III

Did you have the setting explicitly set, or just using default? Without it set, I found it defaults to enabled
Jirka1
Contributor III

James_G wrote:
Did you have the setting explicitly set, or just using default? Without it set, I found it defaults to enabled

I had it disabled and it remained disabled.

Toshi_Esumi
SuperUser
SuperUser

That "net-device" setting was introduced (or forced to be introduced) with 5.6, if I remember correctly. With previous versions, FTNT TAC said "it's always been enabled". But due to the 5.6's structural change, without explicit "disabled", establishment of dialup/dynamic IPsec and tearing down would be slower than policy based IPsec, which doesn't require any dynamic VPN interface creation.

You can see the explanation at below KB, and more in detail in the pdf presentation doc linked at the bottom of the KB.

https://kb.fortinet.com/kb/documentLink.do?externalID=FD41498

 

I noticed "set net-device enable" even for my static IPSec when I upgraded my test 60E to 6.2.3. Since it's static, no reason to be "enabled". But they must have decided to make everything "enabled" since it's safer. I don't know why yours don't work but must be something to do with the type of your IPSec and the previous config for "set tunnel-search { selectors | nexthop }" setting. I recommend you open a ticket to clarify why "enable" broke your IPSec.

 

I was to open a ticket to ask why they decided to enable it even for "static" IPsec. But since we decided not to go to 6.2.3, instead going to 6.0.8, I lost my reason to ask them at this time.

James_G

TAC call raised

 

I use FEC on this tunnel, I wonder if this is any way linked. Will update when I know more.

James_G

TAC are not helpful just yet, they responded that the set net-device should be set to "disable", and if I have further issues with it set to disable then get some trace results. Totally missing the point that the default has changed from disable to enable at 6.2.3, without any reference in notes.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors