Redundant IPsec tunnel stays up even if peer is offline

[sidp]

I need help with configuring redundant IPsec tunnels. The peer firewall has 2 public IP addresses. When the primary ISP is offline, the firewall routes everything through the backup ISP, which is working fine so far.

On our Fortigate, I have configured two IPsec tunnels and, as recommended in many posts, I have set the priority of the static route for the backup tunnel higher. Unfortunately, this is not working for me. I suspect the issue lies with the tunnel configuration rather than the routing. Even when the primary ISP is offline at the customer's end and the tunnel is established through the backup ISP, the status of the primary tunnel remains up on the Fortigate. Because it doesn't switch to down, the routing is likely not functioning properly. At least that's my guess.

After about 45 minutes the tunnel changed to state down but this is probably because of the "keylifeseconds 3600" in phase 2.

Can someone help me with this?

I have replicated this in a lab environment and obtained the same result. Here is the configuration from my lab:

Spoiler

forti01 # show vpn ipsec phase1-interface isp01
config vpn ipsec phase1-interface
edit "isp01"
set interface "port1"
set keylife 28800
set peertype any
set net-device disable
set proposal des-sha1
set localid "1.1.1.1"
set dhgrp 5
set remote-gw 2.2.2.2
set psksecret ***************
next
end

forti01 # show vpn ipsec phase2-interface isp01
config vpn ipsec phase2-interface
edit "isp01"
set phase1name "isp01"
set proposal des-sha1
set dhgrp 5
set keylifeseconds 3600
set src-subnet 172.18.0.0 255.255.0.0
set dst-subnet 100.127.0.0 255.255.0.0
next
end

forti01 # show vpn ipsec phase1-interface isp02
config vpn ipsec phase1-interface
edit "isp02"
set interface "port1"
set keylife 28800
set peertype any
set net-device disable
set proposal des-sha1
set localid "1.1.1.1"
set dhgrp 5
set remote-gw 3.3.3.3
set psksecret ***************
next
end

forti01 # show vpn ipsec phase2-interface isp02
config vpn ipsec phase2-interface
edit "isp02"
set phase1name "isp02"
set proposal des-sha1
set dhgrp 5
set keylifeseconds 3600
set src-subnet 172.18.0.0 255.255.0.0
set dst-subnet 100.127.0.0 255.255.0.0
next
end

forti01 # show router static
config router static
edit 2
set device "isp01"
set dstaddr 100.127.0.0 255.255.0.0
next
edit 3
set device "isp02"
set dst 100.127.0.0 255.255.0.0
set priority 30
next
end

[mgoswami · Accepted solution]

Hi,

You may need to set the monitor interface under the VPN configuration. Please refer to this link:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-Site-to-Site-tunnel-monitor/ta-p...

BR,

Manosh

[mgoswami · Accepted solution]

Hi,

You may need to set the monitor interface under the VPN configuration. Please refer to this link:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-Site-to-Site-tunnel-monitor/ta-p...

BR,

Manosh

[sidp · Accepted solution]

Thanks Manosh, that helped a lot.

After configuring the "set monitor "isp01" in the phase1-interface of isp02 I still had the same issue. I also had to change the DPD "on-idle" instead of "On Demand" and now it works.