Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
PaulM1114
New Contributor III

P2 goes down when another P2 is brought up

FortiOS 5.0.9 using an interface based L2L tunnel with 3 phase2.

I am only able to bring up 2 phase 2's at a time, when I attempt to bring up the 3rd phase 2 (either in VPN monitor or with interesting traffic) the phase 2 listed below it in the list goes down.

All tunnels pass traffic properly when they are up, I just can't have all 3 up at the same time.

The 3 phase 2 are have the same config except for the source network is a different /24.

There is a route to the destination network pointing out the VPN sub-interface and 1 policy specifying the three source networks and the one destination network.  Like I said communication through each P2 works fine when the tunnel is up, I just can't get all 3 P2 to stay up at the same time.  Has anyone seen this or have any advise?

 

Thanks,

 

Paul

 

 

12 REPLIES 12
emnoc
Esteemed Contributor III

Never heard of this. I have on some  FGT, like  8 or more phase2 tunnlels with route based.

Qs?

 

Can you share the phase2 configs? Is the tunnel termination on another FGT?

 

Are you sure the remote device does not have any  tunnel limitations?

 

Did yo run any  diag debug  like  ike  & diag vpn tunnel list ?

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
JonathanTorian_FTNT

Hi PaulM1114,

 

My guess is that you are not establishing a VPN between two FortiGates.  If this is the case, what you will need to do is create separate P2s per source going to destination.  For example:

 

Source Networks:

192.168.0.0/24

192.168.1.0/24

192.168.2.0/24

 

Destination Network:

172.16.0.0/24

 

Needed phase twos:

P2-1

192.168.0.0/24 -> 172.16.0.0/24

 

P2-2

192.168.1.0/24 -> 172.16.0.0/24

 

P2-3

192.168.2.0/24 -> 172.16.0.0/24

 

Once you do this, you should not have the problem any further when you try to bring up the phase 2 on the FortiGate.  Please note, you will need to make sure the other side of the VPN tunnel is configured exactly the same. 

 

As the previous poster mentioned, please provide us configs if you confirm this is how you have things set up.  This is a very common issue due to misconfiguration, so if that is not the case, something else has to be the culprit.

 

Please let us know if this change works.  I hope this helps!

Dipen
New Contributor III

Hi

 

So you are having one P1 to the same remote destination with three P2s each with a different source.

I suspect that there is an overlap probably because of subnet mask which might be mistyped. Please verify the config and share with us.

 

Regards

 

Ahead of the Threat. FCNSA v5 / FCNSP v5

Fortigate 1000C / 1000D / 1500D

 

Ahead of the Threat. FCNSA v5 / FCNSP v5 Fortigate 1000C / 1000D / 1500D
emnoc
Esteemed Contributor III

 

FWIW

 

If this is the case, what you will need to do is create separate P2s per source going to destination.

 

Actually if it's from  FGT-2-FGT & a route-based vpn, he could actually  get away with a single proxyid of 0.0.0.0/0:0  & just ensure the corrects routes and policies are in place the for the networks that would carry interesting  traffic.

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
ede_pfau
SuperUser
SuperUser

@emnoc:

BIG "if"!

He still would need routes and policy objects for each subnet to make it work.

I personally always go the "multiple phase2" road because it's more RFC compliant, and self-documenting.

 

Could well be overlapping subnets, either given or accidentally by mistyping a subnet mask.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
emnoc
Esteemed Contributor III

I personally list all unique src/dst subnets,  but mainly to get statistics per SAs from the diag vpn tunnel list cmd. if you use the wildcard any, you will not get src-2-dst subnet details by each network.

 

FWIW;

In fortinet schools 7 teachings,  they teach the simplified  0.0.0.0/0:0 method when we are going to FGT-2-FGT.  It's one  configuration that's mistake-free and like posted b4fore you still need routes and the correct fw-policies.

 

With a VPN to anything other than a fortigate appliance, your best bet is to use  the  individual src/dst and try to avoid the 0.0.0.0/0:0 approach. Word of advise from past, if you ever shoud see your self changing the VPN from a FGT-2-<some other vendor> is best to avoid the 0.0.0.0/0:0 approach imho.

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Carl_Wallmark
Valued Contributor

There is also a new command from FortiOS 5.2.1:

 

config vpn ipsec phase1-interface

edit <tunnel>

set mesh-selector-type subnet

end

 

With this is command you can have multiple subnets in source/destination in a single Phase2.

 

http://docs-legacy.fortinet.com/fos50hlp/52/index.html#page/FortiOS%205.2%20Help/ipsec.009.16.html

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
emnoc
Esteemed Contributor III

Correct but you will still need to define the phase2 src/dst subnet in the phase2 configuration & they need to match the vpn remote peer. I wonder if this setting is what's dropped the  p2 monitor reporting from  the other threads on vpn phase2 details being missing ;)

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Carl_Wallmark
Valued Contributor

Yes, you still need to define them, but you can do so with an address object.

 

One of the biggest pain was the paring of subnets,

 

If you had 10 subnets on each side you would have to create almost 100 Phase2 if you needed "any-any" traffic.

Now you can group the objects into a Group and the firewall will take care of the pairing of subnets, thank lord...I mean Fortinet ;)

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors