Multiple dynamic / dial-up IPSec VPN peers not working - tunnels up and down constantly

[ergotherego]

Ran into this issue today and figured I would post the solution, since I couldn't find it.

Situation is a VPN hub/concentrator running 5.2.8 with multiple IPSec VPN peers configured as dynamic/dialup peers. When testing the new firewalls one at a time before shipping out, each one worked fine. But after users received them at their site, none worked. They all kept bouncing up and down. Tunnels would establish, and then with 2-3 seconds go back down again, over and over.

The solution was to disable add-route under the Phase 1 settings for each VPN peer:

config vpn ipsec phase1-interface     edit "DVPN-PEER-1"         set add-route disable     next end

I didn't capture the log message, but what was seen was a message indicating that route 0.0.0.0/0 was being passed from one VPN to the other. Since Phase 2 selectors are set to all zeroes, and add-route is enabled by default for a dynamic peer, the hub firewall was adding a static route for 0.0.0.0/0 each time a VPN came up.

It didn't affect any other VPN tunnels or traffic, just the dynamic peers; guessing due to route cache.

Ps. I also didn't see that message about shifting routes until I configured a VPN debug filter using the known destination address of a VPN peer. With just ike debugging set to -1 I never saw that message.

[Edson3x4]

 i had same issue on hub, to fix  i use " set route-overlap allow" in the fase 2 for network 0.0.0.0/0 to 0.0.0.0/0

[GuitarSepp]

Man, thank you!! I habe been locking over and over again to fix this behavior on different FGTs every time it appears somewhere. My solutions was to revert the dial-in site to the other location if it was possible ...