Received ESP packet with unknown SPI

[gatorHeel]

We're having an issue with IPSEC VPN bewteen two FG60D's (interface).  Static IP on both ends.  On one side, we have two WAN circuits: an existing (wanA) and one new (wanB).  We've had a functional tunnel on wanA for quite some time and no issues, but we're planning to decommission it in favor of wanB.  With wanB, we're able to establish a tunnel but no traffic passes.  Logs on the remote FG show lots of "Received ESP packet with unknown SPI".  In the research we've done, typically this is found when you have different types of gear on the endpoints.  

We've attempted both wizard site-to-site mode and using generic config via CLI, all produce the same results.

Thought it might be an ISP issue with wanB, but we're able to establish a tunnel on wanB to a completely separate endpoint (FG60C this time) and traffic passes without issue.

So on one FG60D, we can establish a functional tunnel to destinationA with wanA but not wanB.  On wanB we can establish a functional tunnel to a destinationB.

FortiOS v5.2.8

Any thoughts? 

[Toshi_Esumi]

How are you splitting the network of interest at Site1 between wanA and wanB? Like:

192.168.0.0/17 <-wanA-Site1 -----+---->Site2 10.0.0.0/16

                                                    I

192.168.128.0/17 <-wanB-Site1----+

[gatorHeel]

Turns out there is some type of IPSEC incompatibility in a topology that includes a Juniper SRX240H2 (provided by ISP) in front of Fortigate.  Fortunately the ISP allowed us to connect their fiber ONU/ethernet handoff directly to the Fortigate.  Tunnel up and traffic flowing without issue.