IPsec tunnel both ends troubleshooting

[nikolaj]

Hello everybody,

If there is a problem in IPSec tunnel, both ends of the VPN tunnel should do troubleshooting?

[Iescudero]

Hi there! That's depend on the issue. With a good documentation and a good understanding, you can tell what's going on if the IPSec Tunnel doesn't bring up. What is the exact problem?

[nikolaj]

The tunnel is up, but a particular site sometimes lost the connection.

[EMES]

It would be best to be able to look at both sides of the tunnel to make sure that the timeout negotiations are the same on both sides. One side may be timing out before the other side of the tunnel.

[EMES]

http://cookbook.fortinet.com/ipsec-vpn-troubleshooting/ That should help with TS commands.

[Iescudero]

nikolaj wrote:

The tunnel is up, but a particular site sometimes lost the connection.

There's a lot of reason or causes that trigger this behavior.

When the tunnel goes down, you have network traffic on it? the links are ok? (I asume that this VPN Tunnel use internet, so a common cause could be the bandwidth usage)

As EMES says, you must check if timers and keys are exactly the same in both IKE phase 1 and 2.

Other question: Both ends are fortigates?