Ran into this issue today and figured I would post the solution, since I couldn't find it.
Situation is a VPN hub/concentrator running 5.2.8 with multiple IPSec VPN peers configured as dynamic/dialup peers. When testing the new firewalls one at a time before shipping out, each one worked fine. But after users received them at their site, none worked. They all kept bouncing up and down. Tunnels would establish, and then with 2-3 seconds go back down again, over and over.
The solution was to disable add-route under the Phase 1 settings for each VPN peer:
config vpn ipsec phase1-interface edit "DVPN-PEER-1" set add-route disable next end
I didn't capture the log message, but what was seen was a message indicating that route 0.0.0.0/0 was being passed from one VPN to the other. Since Phase 2 selectors are set to all zeroes, and add-route is enabled by default for a dynamic peer, the hub firewall was adding a static route for 0.0.0.0/0 each time a VPN came up.
It didn't affect any other VPN tunnels or traffic, just the dynamic peers; guessing due to route cache.
Ps. I also didn't see that message about shifting routes until I configured a VPN debug filter using the known destination address of a VPN peer. With just ike debugging set to -1 I never saw that message.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Just offset the rip hops on one link to ensure traffic is preferred over the other. Just use one side to offset in or out for the offset and that will increase the metric for the networks that matches.
Take a look at the following for a example.
[link]https://forum.fortinet.com/tm.aspx?m=131494[/link]
PCNSE
NSE
StrongSwan
i had same issue on hub, to fix i use " set route-overlap allow" in the fase 2 for network 0.0.0.0/0 to 0.0.0.0/0
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1702 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.