Site to Site VPN Down

[galal2010]

Site to site VPN one site DDNS is Down

Dears

I configured stie to site VPN between 2 Fortigate firewalls and the tunnel is down

I have 2 Fortigate sites

Site 1 : FGT60 use DDNS

i have 3 WAN interfaces (Wan 1 , Wan 2 , Wan 3) connected to internet through ADSL router so they have private IP and router do NAT for real IPs these interfaces are connected to SDWAN zone with IP (0.0.0.0/0.0.0.0)

VPN configuration on this site:

remote gateway: static IP address

IP address: (Public IP of remote site)

interface: WAN 1 (has private IP)

Site 2 : FGT30 has static Public IP

VPN configuration on this site:

remote gateway: Dyanmic DNS

IP address: (FQDN)

interface: WAN interface with Public IP

[abarushka]

Hello,

I would recommend to check whether DNS entry can be resolved and port forwarding is configured. Also you may consider to collect ike debug traces on both IPsec peers:

diagnose debug application ike -1
diagnose debug enable

[galal2010]

this is debug

ike 0:negotiation timeout, deleting
ike 0:connection expiring due to phase1 down
ike 0: deleting
ike 0: deleted
ike 0: schedule auto-negotiate

DNS can be negotiated but what do you mean with port forward

[abarushka]

Hello,

Can you please elaborate where ike debug was collected (IPsec initiator or responder)?

IPsec tunnel cannot be established due to time out.

As far as I understand FGT60 is behind NAT. Therefore port forwarding will be required.

[galal2010]

Debug from Responder

Dear i will explain situation in details

please check image

[galal2010]

WAN port1 in fortigate 1 is a member of SD-WAN Zone does this affect configuration of VPN

[abarushka]

Hello,

I would recommend to collect ike debug traces on both IPsec peers simultaneously and check whether ike traffic is sent and received by both IPsec peers and check proposals:

diagnose debug application ike -1
diagnose debug enable

[galal2010]

if one of the firewalls has 3 interfaces each interface is connected to different ADSL Router and they are configured in SD-WAN Zone with rule redundancy with source IP

Can i configure VPN for one of those interface with traditional configuration or it have special configuration

[Faiza_Emam_Delhi]

Hello,

If your site-to-site VPN tunnel is down, there are several things you can check to troubleshoot the issue:

1. Verify the VPN configuration: Make sure that the VPN configuration settings on both FortiGate devices are correct and match each other. Check the remote gateway IP address or FQDN, the local gateway IP address, and the authentication settings.

2. Check the WAN interfaces: Make sure that the WAN interfaces on both FortiGate devices are up and running. Check the physical connections, and check the interface settings to make sure they are configured correctly.

3. Check the firewall policies: Make sure that the firewall policies on both FortiGate devices are configured correctly to allow traffic to pass through the VPN tunnel. Check the source and destination addresses, the protocols and ports, and the action settings.

4. Check the SD-WAN configuration: If you're using SD-WAN to load-balance your WAN interfaces, make sure that the SD-WAN configuration is correct and not causing issues with the VPN tunnel. Check the routing settings, the link monitoring settings, and the interface settings.

5. Check the logs: Check the logs on both FortiGate devices to see if there are any error messages or warnings related to the VPN tunnel. Look for messages related to the VPN configuration, the WAN interfaces, and the firewall policies.

Regarding the DDNS issue, if one of the FortiGate devices is using DDNS and the DDNS service is down, this could cause the VPN tunnel to fail. You may need to switch to a static IP address or use a different DDNS service to ensure that the VPN tunnel stays up.

I hope this helps! Let me know if you have any further questions.

[galal2010]

get vpn ipsec tunnel details

gateway
name: 'Egy-Saudi-VPN'
local-gateway: 41.178.109.139:0 (static)
remote-gateway: 176.44.67.135:0 (static)
dpd-link: off
mode: ike-v1
interface: 'wan1' (5) vrf:0
rx packets: 0 bytes: 0 errors: 0
tx packets: 0 bytes: 0 errors: 1