RDP Sessions randomly dropping over IPSEC VPN

[luis-estanga]

Hi,

We have currently 20 FGT40F branches connecting via VPN IPSEC with the FGT1100E HQ.

Users on the branches connect to a Cluster-RDS via RDP and uses the services/servers from the HQ network.

The issue we have is that the RDP sessions are dropping randomly during the day (sometime just once or twice a day) on any branch and sometimes on random hosts.

Users on HQ that connects also to the Cluster-RDS never had any complain about connection being dropped, so we assumed that the servers are OK.

We performed several troubleshooting steps to try and solve this issue but the problem persists. We took 2 branches to test configurations and if they worked we'd replicate to all the others. So far we tried:

- set auto-asic-offload disable

- set npu-offload disable

- VPN IPSEC: AES-128 and SHA-1 Lifetime:28800s (on both phases)

- system session-ttl for RDP: 28800s

Any help would be appreciated.

Thanks

[hbac]

Hi @luis-estanga,

Do you have any security profiles enabled in firewall policies? If yes, you can try disabling them to see if it helps. You can also check the logs at the time of disconnection to see if you can find any drops. It will be useful to collect debug flow and packet captures when the issue occurs: 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sn...

Regards,

[luis-estanga]

Hello @hbac 

We have no security services (AV,IPS,SSL,Webfilter, Appcontrol) running on the policies on both sides.

We cannot perform a packet capture because there are so many hosts between all branches and algo because occurs on random times of the day.

Sometimes on the traffic logs we get a server-rst when the user complains but not always. We checked on the server side and we get no error around the time of the drop.

Thanks