Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
FernandoDM
New Contributor

Site-to-Site Tunnel failing...

Hello, Having issues keeping a VPN Site-to-Site tunnel up..

 

My devices are a FG100D and the remote device is a FG30, both have been updated to v5.2.3 firmware. I set up the site-to-site with the VPN wizard, the VPN tunnel was working for about 3 days and then it stopped.

 

Tried debugging on the near end (Remote end FG30 device is about an hour drive away, I would like to resolve it from this end if possible without having to drive there). In the debug it says: P1_RETRANSMIT about 3 times then goes to a negotiation timeout, deleting... Connection expiring due to phase1 down.

 

Tried setting the VPN interface to IKE V1 and aggressive mode but same result. Set it back to IKE2. Not sure if that is the default because setting up with the wizard does not specify. I figured it would default to IKE V2.

 

Looked at a few forum threads and this one had some interesting commands to restart the VPN tunnel:

 

https://forum.fortinet.com/tm.aspx?m=107918

# execute router restart

# diagnose debug application ike 2 # diagnose debug enable # diagnose vpn ike restart

 

Any help is appreciated, Thanks!

2 Solutions
emnoc
Esteemed Contributor III

Logs, show outputs, & configuration details would be nice, also did you do this in  Route or Policy based, but what I would do. if either party are behind  NAT translation; " than enabled nat-T or deploy ikev2 "

 

2nd config the exact proposals. In fact I would copy the config from  one  FIREWALL and used it at the other side ( just change the interface and address )

 

for the last step, I would copy the one side  phase2 settings and once again swap the src/dst-subnets details

 

lastly, ensure that fwpolicy and a route-exists (  the latter is only for route-base )

 

next, google socpuppet vpn troubleshooting for good t-shoot steps.

socpuppet.blogspot.com/.../site-2-site-routed-vpn-trouble-shooting.html

 

 

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
emnoc
Esteemed Contributor III

All zero is not the problem, as long as the remote & local vpn devices are  using 0.0.0.0/0:0 as the same for it's src/dst-subnet than that's okay. And if both devices are fortigate that's okay also.

 

What's probably the issues, you don't have the auto-neg enable under the phase2 settings;

 

 

config vpn ipsec phase2-interface     edit "sega-p2"         set phase1name "sega-main"

        set auto-negotiate enable         set src-subnet 0.0.0.0/0         set dst-subnet 0.0.0.0/0     next

I believe you need to check the full cfg from the CLI and you will find the above is set to "disable". Confirm also the keepalives are the same for the SA & enabled

 

e.g ( enabled and set for seconds at 1hour )

 

        set keepalive enabled          <------KAs are enabled         set keylife-type seconds     <---- lifetime is set for seconds vrs bytes

        set keylifeseconds 3600     <------1 hour

 

Try the above  for both devices and re-monitor and I bet you will have no problems in the future.

 

 

   

 

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
21 REPLIES 21
davi_bittencourt
New Contributor

FernandoDM wrote:

Hello, Having issues keeping a VPN Site-to-Site tunnel up..

 

My devices are a FG100D and the remote device is a FG30, both have been updated to v5.2.3 firmware. I set up the site-to-site with the VPN wizard, the VPN tunnel was working for about 3 days and then it stopped.

 

Tried debugging on the near end (Remote end FG30 device is about an hour drive away, I would like to resolve it from this end if possible without having to drive there). In the debug it says: P1_RETRANSMIT about 3 times then goes to a negotiation timeout, deleting... Connection expiring due to phase1 down.

 

Tried setting the VPN interface to IKE V1 and aggressive mode but same result. Set it back to IKE2. Not sure if that is the default because setting up with the wizard does not specify. I figured it would default to IKE V2.

 

Looked at a few forum threads and this one had some interesting commands to restart the VPN tunnel:

 

https://forum.fortinet.com/tm.aspx?m=107918

# execute router restart

# diagnose debug application ike 2 # diagnose debug enable # diagnose vpn ike restart

 

Any help is appreciated, Thanks!

I had the same problem. In my case, the VPN interface has configured to use PPPoE mode. I opened a ticket with the fortinet and the support tell me that is a bug. The solution is upgrade the firmware to 5.4.0 or wait for 5.2.8 (last 2 weeks of july, 2016).

 

Support Fortinet:

 

"Dear Customer, Thank you for contacting the Fortinet Technical Assistance Center. My Name is *********** and I will be addressing your case. I did a research and indeed your issue is related to a known bug. Bug#0367491 - IPSec tunnel using wan1 interface in pppoe mode, cannot get back up after PPPoE disconnect and reconnect Bug is fixed on version 5.4.0 For version 5.2.x it is planned to be fixed on 5.2.8 which will be release during the first 2 weeks of July. Your solution will be to go for 5.4.0 which I do not recommend doing for now, or to wait for the 5.2.8 release on which a fix will be provided."

 

 

Admin: This post has been modified to remove the name of the engineer.  We ask that you do not post the names of individuals without their consent.

ksm
New Contributor

Thanks for the informations !

 

I keep it in my head.

 

Actually in our case, we stopped making IPSEC VPN tunnel for this special customer, and use VPN SSL instead. We have no more issues.

 

Best regards.

 

JS

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors