P2 goes down when another P2 is brought up

[PaulM1114]

FortiOS 5.0.9 using an interface based L2L tunnel with 3 phase2.

I am only able to bring up 2 phase 2's at a time, when I attempt to bring up the 3rd phase 2 (either in VPN monitor or with interesting traffic) the phase 2 listed below it in the list goes down.

All tunnels pass traffic properly when they are up, I just can't have all 3 up at the same time.

The 3 phase 2 are have the same config except for the source network is a different /24.

There is a route to the destination network pointing out the VPN sub-interface and 1 policy specifying the three source networks and the one destination network.  Like I said communication through each P2 works fine when the tunnel is up, I just can't get all 3 P2 to stay up at the same time.  Has anyone seen this or have any advise?

Thanks,

Paul

[emnoc]

Never heard of this. I have on some  FGT, like  8 or more phase2 tunnlels with route based.

Qs?

Can you share the phase2 configs? Is the tunnel termination on another FGT?

Are you sure the remote device does not have any  tunnel limitations?

Did yo run any  diag debug  like  ike  & diag vpn tunnel list ?

[JonathanTorian_FTNT]

Hi PaulM1114,

My guess is that you are not establishing a VPN between two FortiGates.  If this is the case, what you will need to do is create separate P2s per source going to destination.  For example:

Source Networks:

192.168.0.0/24

192.168.1.0/24

192.168.2.0/24

Destination Network:

172.16.0.0/24

Needed phase twos:

P2-1

192.168.0.0/24 -> 172.16.0.0/24

P2-2

192.168.1.0/24 -> 172.16.0.0/24

P2-3

192.168.2.0/24 -> 172.16.0.0/24

Once you do this, you should not have the problem any further when you try to bring up the phase 2 on the FortiGate.  Please note, you will need to make sure the other side of the VPN tunnel is configured exactly the same. 

As the previous poster mentioned, please provide us configs if you confirm this is how you have things set up.  This is a very common issue due to misconfiguration, so if that is not the case, something else has to be the culprit.

Please let us know if this change works.  I hope this helps!

[Dipen]

Hi

So you are having one P1 to the same remote destination with three P2s each with a different source.

I suspect that there is an overlap probably because of subnet mask which might be mistyped. Please verify the config and share with us.

Regards

[emnoc]

FWIW

If this is the case, what you will need to do is create separate P2s per source going to destination.

Actually if it's from  FGT-2-FGT & a route-based vpn, he could actually  get away with a single proxyid of 0.0.0.0/0:0  & just ensure the corrects routes and policies are in place the for the networks that would carry interesting  traffic.

[ede_pfau]

@emnoc:

BIG "if"!

He still would need routes and policy objects for each subnet to make it work.

I personally always go the "multiple phase2" road because it's more RFC compliant, and self-documenting.

Could well be overlapping subnets, either given or accidentally by mistyping a subnet mask.

[emnoc]

I personally list all unique src/dst subnets,  but mainly to get statistics per SAs from the diag vpn tunnel list cmd. if you use the wildcard any, you will not get src-2-dst subnet details by each network.

FWIW;

In fortinet schools 7 teachings,  they teach the simplified  0.0.0.0/0:0 method when we are going to FGT-2-FGT.  It's one  configuration that's mistake-free and like posted b4fore you still need routes and the correct fw-policies.

With a VPN to anything other than a fortigate appliance, your best bet is to use  the  individual src/dst and try to avoid the 0.0.0.0/0:0 approach. Word of advise from past, if you ever shoud see your self changing the VPN from a FGT-2-<some other vendor> is best to avoid the 0.0.0.0/0:0 approach imho.

[Carl_Wallmark]

There is also a new command from FortiOS 5.2.1:

config vpn ipsec phase1-interface

edit <tunnel>

set mesh-selector-type subnet

end

With this is command you can have multiple subnets in source/destination in a single Phase2.

http://docs-legacy.fortinet.com/fos50hlp/52/index.html#page/FortiOS%205.2%20Help/ipsec.009.16.html

[emnoc]

Correct but you will still need to define the phase2 src/dst subnet in the phase2 configuration & they need to match the vpn remote peer. I wonder if this setting is what's dropped the  p2 monitor reporting from  the other threads on vpn phase2 details being missing ;)

[Carl_Wallmark]

Yes, you still need to define them, but you can do so with an address object.

One of the biggest pain was the paring of subnets,

If you had 10 subnets on each side you would have to create almost 100 Phase2 if you needed "any-any" traffic.

Now you can group the objects into a Group and the firewall will take care of the pairing of subnets, thank lord...I mean Fortinet ;)