IPsec Tunnel Established but Experiencing Intermittent Ping Timeouts

[mhrth]

Hi,

We have set up an IPsec VPN tunnel between our on-premises FortiGate firewall and Alibaba Cloud. Both Phase 1 and Phase 2 show as "up," and the tunnel is passing traffic. However, we are observing:

1. Severe slowness when accessing web applications hosted on Alibaba Cloud.

2. Intermittent ping failures (frequent "Request Timed Out" errors) across the tunnel.

Troubleshooting Done So Far:

• Verified that encryption/authentication settings match on both ends.

• Confirmed routing (static/Policy-Based) and firewall policies are correctly configured

May I know if there are any factors that could contribute to this issue?

Any insights or best practices to resolve this would be greatly appreciated!

Thanks.

[knaveenkumar]

Hi , 

Please refer the below document.

Tried to ping between two public ip continuously with repeatedly with packet 100 and check any packet loss  

Also please test the path MTU from FortiGate site.
From a PC behind the FortiGate, please do the below:

ping <server ip> -f -l 1460

please reduce the value like 1450 , 1430 , 1410 and 1400 then check the status

Also, when you are facing the issue provide the below output

>> Connect to your FortiGate, run the below commands, and initiate a ping from source to destination

Putty1:
---------------------

diagnose debug reset
diagnose debug disable
diagnose debug flow show console en
diagnose debug flow show fun en
diagnose debug flow filter clear
diagnose debug flow filter saddr b.b.b.b -------------where b.b.b.b is the source IP address from where you are initiating the ping from
diagnose debug flow filter daddr y.y.y.y --------------where y.y.y.y is the destination IP address to where you are initiating the ping to
diagnose debug flow filter proto 1
diagnose debug flow trace start 100
diagnose debug enable

After 5-10sec, disable the logs by executing
diagnose debug disable
diagnose debug flow trace stop

Putty2:
---------------------
>>Simultaneously open an another session of putty, start the logging and run the below command

diagnose sniffer packet any "host y.y.y.y and icmp" 6 0 a --------------where y.y.y.y is the destination IP address to where you are initiating the ping to

Putty3:
--------------------
Diagnose VPN tunnel list
get router info routing-table database
get router info routing-table details b.b.b.b -------------where b.b.b.b is the source IP address
get router info routing-table details y.y.y.y --------------where y.y.y.y is the destination IP address
get router info routing-table all

[mhrth]

Hi @knaveenkumar ,

I have attached both ping and MTU test. 

[sjoshi]

Hi @mhrth ,

Please verify if any dos policy or traffic shaping i setup

Is there latency when pinging towards any server in the cloud.

Is there any latency towards the remote peer IP

Further can try setting the tcp mss value to 1300

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-TCP-MSS-value/ta-p/194518

[mhrth]

Hi @sjoshi ,

There are no dos policy or traffic shapping configured.

There are no specific latency towards the internal server in the cloud and the remote public IP.

Thanks.

[sjoshi]

@mhrth 

based on the above logs shared I can see RTO when pinging with 1450, 1460

Can you change the tcp mss value in the firewall policy

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-TCP-MSS-value/ta-p/194518

[mhrth]

Hi @sjoshi,

I have changed the tcp mss value in the firewall policy but still encountered the same issue.

Thanks.