Second IPsec tunnel inactive with no activity

[dbah01]

Hi All,

I have two custom IPSec tunnels setup on FortiGate from same local WAN interface connecting to remote site on different WAN interfaces. The first tunnel is up and running without issues, but the second tunnel shows inactive and show now activity under the events log. The tunnel interface behaves as if disabled but it's not. Any ideas where to start looking? Checked the setting again and again.

FortiGate firmware v7.0.15 build7480

Some details below:

get vpn ipsec tunnel summar

'HUB-V1' 197.245.xx.xx:0 selectors(total,up): 1/1 rx(pkt,err): 12247/0 tx(pkt,err): 16156/2

'HUB-V2' 169.255.xx.xx:0  selectors(total,up): 1/0 rx(pkt,err): 0/0 tx(pkt,err): 0/1 

FW # get vpn ipsec tunnel details

gateway
name: 'HUB-V2'
local-gateway: 217.91.xx.xx:0 (static)
remote-gateway: 169.255.xx.xx:0 (static)
dpd-link: off
mode: ike-v1
interface: 'ppp2' (25) vrf:0
rx packets: 0 bytes: 0 errors: 0
tx packets: 0 bytes: 0 errors: 1
dpd: on-demand/unnegotiated
selectors
name: 'HUB-V2'
auto-negotiate: enable
mode: tunnel
src: 0:192.168.10.0/255.255.255.128:0
dst: 0:192.168.0.0/255.255.255.0:0

[kcheng]

Hi @dbah01 ,

Try checking the debug log for the specific tunnel:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPN-tunnels/ta-p/195955

Since you are on FortiOS 7.0.15, use the following commands to capture the IKE debug log:

diagnose vpn ike log filter dst-addr4 x.x.x.x 
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable

[dbah01]

Thanks for the support, issue was relating to below topic. I'm used to SonicWall and was not aware of this requirement.

 Technical Note: Log message 'ignoring request to establish IPsec SA, no policy configured'