IPsec tunnel failing frequently..

[TJNIHAL]

Hello, Having issues keeping a IPsec Site-to-Site tunnel up..

I am having FG60D device successfully connect to azure using FortiGate Cookbook - IPsec VPN to Microsoft Azure (5.2)  

but tunnel got disconnect frequently in few hours and Had to reboot 60D always to get the tunnel bring up

firmware version : V5.2.6, build711

phase 1 proposal :

encryption AES 128 authentication SHA256

encryption AES 256 authentication SHA256

encryption AES 128 authentication SHA1

encryption AES 256 authentication SHA1

Diffie-Hellman group       : 2

key lifetime                    : 56600 seconds

phase 2 proposal :

encryption AES 128 authentication SMA1

encryption AES 256 authentication SHA1

encryption AES 128 authentication SHA256

encryption AES 256 authentication SHA256

Replay detection [enabled]

PFS                    [enabled]

Diffie-Hellman group    : 2

Local Port            [enabled]

Remote port        [enabled]

Protocol              [enabled]

Autokey keep Alive  [enabled]

Auto-negotiate        [enabled]

key lifetime             : 7200 seconds

It seems known problem in 60D

Any help is highly appreciated,

Thanks!

Nihal

[ede_pfau · Accepted solution]

This problem is related to key lifetime differences, not hardware or firmware version.

From what I've read what other vendors recommend the following IPsec parameters are needed:

phase1

IKEv1

PSK

DH group 2

encryption AES256 or AES128 or 3DES

hash SHA1

key lifetime: 28800 sec

phase2

encryption AES256 or AES128 or 3DES

hash SHA1

no PFS

no Dead Peer Detection

key lifetime 3600 sec

I would enable auto key renegotiation for both phase1 and phase2.

Especially the key lifetimes given in the Cookbook article and video are odd (56600 and 56660). I can only assume they were meant to be 2 * 28800 = 57600. All other vendors follow Microsoft's parameters, 28800 and 3600 seconds so I would try that first.

[TJNIHAL]

Hello Ede,

thanks for your replay

I will change the configuration as per your suggestion and comeback with result soon.

Thanks,

Nihal

[TJNIHAL]

Thanks Ede,

by doing as per your suggestion IPsec tunnel failing disappear

now working smoothly..

Thanks again,

Nihal

[ede_pfau]

!