IPSec VPN stops passing traffic

[alexburtt]

Hi,

I have a site to site IPSec VPN tunnel, the local end is a Fortigate 40c and the remote is a Cisco ASA.

The Phase 2 has 36 separate network subnets, hence 36 separate tunnels I guess.

The VPN traffic to the remote end will suddenly stop and the connection appears to drop. To rectify it I run the diag vpn tunnel reset and everything comes straight back up.

Could it be a key life time out issue? Phase 1 is set to 28800 and Phase 2 is set to 7200

Or could it be the session ttl ?

Sorry it's a bit vague but if anyone can assist let me know what info you need an would be happy to provode.

thanks

Alex..

[Road_Warrior]

I am planning on upgrading, but it also appears that at least 1 person is running 5.2 code.

I am currently running a 80C @ 4.3.11 . We use it strictly for IPsec

[mhamdy]

I faced similar behavior like that which is VPN is stopped to pass traffic though it is up till i reset the VPN.I opened  a ticket and got reply to make the below changes and test it  and the issue is route caching:  http://kb.fortinet.com/kb...externalId=13842  http://kb.fortinet.com/kb...ternalId=FD36695  http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36184

[ede_pfau]

If you use IPsec you should install blackhole routes for the private network addresses you use.

If you use IPsec with a default route pointing to it you should absolutely define blackhole routes.

Effect: this will speed up route recovery after a IPsec tunnel goes down and comes up again.

Here (https://forum.fortinet.com/tm.aspx?m=132141) I posted a longer explanation for it. In this post, there is a link leading to an older post where I linked a batch command script installing blackhole routes for all RFC 1918 private subnets.

[emnoc]

Also blackhole routes needs  the proper priority set and this is what fortinet has been recommending as std practices  for awhile. To include what Ede already pointed out, the blackhole routes will keep src-traffic from leaking out via the wan for example & when the tunnel is down.

We should also try to install  blackhole for  any other "martians"  ( APIPA,  multicast etc.....

http://socpuppet.blogspot...ms-within-fortios.html

( FWIW the  non A B C  class are  & BHroutes are still a issue in  5.4.x )

FGT100DFW (666) # set dst 240.0.0.0/4

ip address must be a class A, B, or C ip

value parse error before '240.0.0.0/4'

Command fail. Return code -8

http://socpuppet.blogspot.com/2014/09/fortigate-best-comon-practices.html

So you can do  any of this at the firewall and where not applicable at the next-hop router gateway or inject these via a routing protocol if your running dynamic-protocols

ken