IPSec VPN stops passing traffic

[alexburtt]

Hi,

I have a site to site IPSec VPN tunnel, the local end is a Fortigate 40c and the remote is a Cisco ASA.

The Phase 2 has 36 separate network subnets, hence 36 separate tunnels I guess.

The VPN traffic to the remote end will suddenly stop and the connection appears to drop. To rectify it I run the diag vpn tunnel reset and everything comes straight back up.

Could it be a key life time out issue? Phase 1 is set to 28800 and Phase 2 is set to 7200

Or could it be the session ttl ?

Sorry it's a bit vague but if anyone can assist let me know what info you need an would be happy to provode.

thanks

Alex..

[alexburtt]

BUMP

[vjoshi_FTNT]

Hello Alex,

First, see, how often the issue occurs, if it is at regular intervals, like every 6 hours and also if the same behavior is seen for all the phase2's.

Enabling auto-negotiate or Keep alive can help, they are explained in the below KB:

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=12069

You may have to use 'config vpn ipsec phase2-interface' if it is a route based vpn

Hope that helps.

[alexburtt]

Hi,

Thanks for your reply.

The time between the down time is random, seems to be no pattern to it.

Can be 30 mins to 4 hours.

Keep Alive and Auto Negotiate are both enabled on all the phase 2's for this particular tunnel. This behaviour only affects all phase 2's for this particular tunnel. I have other tunnels on this unit for other site to site IPsec VPNs which do not exhibit this behaviour, which again do have Keep alive and Auto negotiate enabled.

Thanks

Alex.

[vjoshi_FTNT]

It is worth to enable DPD on both ends.

- Also, please get the event logs of the Fortigate when the tunnel goes down.

[JLatta80]

Did you have any luck fixing this issue? I'm experiencing the same issue and have found nothing to fix it. I have multiple Fortinets going back to my ASA at corporate but only 1 of them is having this issue where it says the tunnel is active but doesn't pass any traffic. The only fix that I have is administratively bring down the VPN and then bringing it back up.

Right now I do not have any rhyme or reason this is happening but of course it happens at night when traffic is low but that shouldn't kill the tunnel.

[emnoc]

The cisco and DPD is a hit and missed and badly support between the two bottom line it's not compatible.

When the  tunnels are down, run diag sniffer packet for the vpn-gateway and see if any packets are being sent and any response?

As an alternative, you can build a ikev2 policy on the cisco and running ikev2 on your FGT tunnels. IKEv2 supports DPD natively and you might have better luck. Cisco ASA has supported IKEv2 go back to to 9.0 code or maybe earlier.

[Magesh]

Hi,

Any luck on this?

seems to be i have the same issue. VPN Tunnels where up but traffic wasn't flowing.

I was running a sniffer trace on the tunnel, and I see them sending packets through the tunnel but nothing coming back, thought their end was having an issue.

but they seems to be don't see a tunnel up to my peer and when they checked their logs there were nothing trying to connect from my peer.

I just brought the tunnel down and it wouldn't come back up,I flushed the ike cache (diagnose vpn ike gateway flush) and was able to bring the tunnel up after that. 

i was able to see the traffic now.

This happened second time in this week.

Any suggestions???

[Road_Warrior]

Any luck on this issue? I have the same exact issue, but it affects 3 tunnels and it's always the same 3. Unlike the previous posts, I fix my issue by putting in a bogus password and then put in the proper password. It starts working again. Resetting or clearing the tunnel does not do it.

It used to be only 1 tunnel and is was rare, but now it happens at least 2 times a day on 3 tunnels. I thought I was running into a tunnel limitation. I did a print tablesize and attached it to my ticket. I'm not sure how to read those numbers.

vpn.ipsec.phase1: 0 200 200 vpn.ipsec.phase2: 0 200 200

Thanks!

[rwpatterson]

It would help this post if all of you experiencing this problem would indicate your platform and code level. You could at least compare like situations as opposed to guessing.