IPsec Dynamic DNS Addresses Not Updating

[rharms_tarc]

I have around 180 IPsec tunnels established using Dynamic DNS for the remote gateway.  The local end is a FortiGate 300E running v7.4.7 build2731.  The remote ends are Digi cellular routers installed on our fleet of transit buses.  As they are located on buses, obviously the tunnels are not up and running all the time, just when the bus is in operation.  At times, the FortiGate seems to miss a Dynamic DNS update which will cause that tunnel not to come up.  In most cases, the record from our DNS provider updates correctly to reflect the buses' new public IP address.  But for whatever reason, the FortiGate continues to try to connect to the old IP address.  If I go into the FortiGate and force it to do a DNS query for the tunnel (generally by changing the Dynamic DNS entry to a different DNS entry and then changing it back to the correct one), the FortiGate will update the address and the tunnel will come right up.

So I'm wondering if there is a way to make the FortiGate do those DNS queries more frequently or more dependably so that they will pick up the Dynamic DNS updates from our DNS provider?

[nevan]

Dear rharms_tarc,

Please try increasing ddns TTL, set the monitoring interface, enable if use of public IP if environment supports and adjust the update interval.

config system ddns
set ddns-ttl {integer} 
set monitor-interface <interface-name>
set update-interval {integer}
set use-public-ip enable
next
end

Additionally, the FQDN refresh time can be set more frequent way:

config system dns

set fqdn-min-refresh <10-3600*>

end

The default is 3600 and the minimum value is 10s.

Try the workaround, which might improve.

Regards.

[sw2090]

In Fact there is some nasty bug with FortiGate Ipsec and dyndns. I ran into that too and i don't think Fortinet ever fixed it (even though TAC aknowledged it):

when you have dyndns remote gateway on an ipsec and you disabled the phase1 auto negotiation on your FGT (or set the tunnel to "quiet") it will no longer update the dynds for the remote gw. Usually you want those IPSEC to be build up by the opposite side then this will hit you :(

I am having this with workstations that are only used on fairs. These are only online when they are at a fair. So I cannot do S2S because of the bug (because having p1 autonegotiation enabled my local fortigate will keep creating "dead" SAs on this ipsec).

Dial up Ipsec are not affected because these don't have a remote gw on the FGT side (but have other disadvantages that hit me here).