Site2Site remote behind NAT

[Yngve0]

I have a running VPN between 2 sites 2x FGT60C; Primary site have DynDNS with publig ip on FG's WAN interface. Remote site have internal IP behind a NAT-device controlled by the ISP. Due to limitation regarding interface routing and Policybased routing for DialIn I have configured both ends with normal DynDNS-ipsec. Everything works mostly fine and stable. I have devices on the remote site which frequently poll both the Primary site via VPN and external web-services "directly". Unfortunately it happening sometimes (1-2 times a week) that the vpn goes down without comming up again. Since remote end only is available through VPN; I am not able to manage remote end when the vpn is down. "diag sniffer packet any "src host remoteIP" on primary site indicates that the remote end does not try to recreate the tunnel.

I could do a remote power-Cycle with a GSM-controlled socket; after power-cycle the tunnel cames up again.

What can I do to trig automativ reconnection of remote site and / or debug this issue?

config vpn ipsec phase1-interface
    edit "vpn_PrimarySite"
        set type ddns
        set interface "201 TLC"
        set ike-version 2
        set proposal aes256-sha512
        set remotegw-ddns "primarysite.dyndns.svc"
        set psksecret ENC xxxx
    next
end
config vpn ipsec phase2-interface
    edit "vpn_PrimarySite"
        set phase1name "vpn_PrimarySite"
    next
end

[Markus · Accepted solution]

Hi,

On the remote site, edit your phase 2 interface and set keepalive enable --> this will re-connect your VPN in case it goes down.

Best