The VPN tunnel goes down

[#1]

I have a FortiGate 50B firmware 3.00-b0730 (MR7 Patch 1) with 10 VPN IPSec fully functional (to Cisco devices, jupiter etc.) of my clients, I migrated the VPN to a FortiGate 200B firmware v4.0, build0303, 101214 (MR2 Patch 3) with the same configuration, but i found numerous problems with some device vpn for example with a Cisco ASA 5520 with software release 8.2 (2). At first, the tunnel is established perfectly, but after a some hours, the tunnel goes down and I have to reset the tunnel. Why? What has changed from version 3.00-b0730 (MR7 Patch 1) the fully functional version v4.0, build0303, 101,214 of the FortiGate? thanks

[rwpatterson]

A couple of questions regarding the new unit: 1) Did you migrate the tunnels over from scratch? 2) Did you copy the config with the tunnels then upgradethe 200B? 3) Did you cut/paste the tunnels into the CLI?

[#3]

Hello, I did not do copy and paste, I got the new device I upgraded the firmware and then I typed the commands to create the vpn.(with the same parameters).

[#4]

@ FraArm: In the phase 2 definition for the tunnel, try adding: set auto-negotiate enable

This solved my problem, thanks.

[#5]

Seems like we have the same issue with our FG1240B, 4.0 MR1 build 5135. If no traffic is flowing in the tunnel, it goes down and we have to manually bring up the tunnel again. to rwpatterson : 1. No. 2. Yes. 3. We did cut and paste the tunnels via CLI. Thanks in advance

[#6]

Hello. I opened a ticket to the FortiGate service center (Type P3), but they do not respond from a week. For me it' s a bug in the new version, ... You know how I can open a complaint in the Headquarter? there Is anyone of the development team of FortiGate in this forum? Help me!!!

[rwpatterson]

@ FraArm: In the phase 2 definition for the tunnel, try adding:

set auto-negotiate enable

@rhetsky Please start a new post.

[#8]

Hello, thanks for the answer, but Is already set :-( I explained to the FortiGate technician in the ticket, wich the same configuration with the 3 version of the firmware work well. WHY??? I tried with many configurations but with no result. the technician was connected to my device but nothing... Are 7 days wich the " technical of fortigate " don' t answer me....How is possible? I have a disservice from 15 days, and in my company all manager complain with me!! I think which the FortiGate devices are very professional and of good quality, but the assistance is very poor (in Europe)! I hope someone of fortigate, do me answer.... I am exhausted!!! [:' (]

[ede_pfau]

just as a suggestion: if the FG200B is in production environment and management is pressing you, why not downgrade to 3.00MR7 patch 10 (latest) and have it working? You stated that with 3.00 MR7 you had no problems. You could even put the 50B back into operation and solve the issue in the lab. One more hint: we had massive problems after upgrading from 4.1.2 to 4.1.6 in that the VPNs came up but failed repeatingly. They couldn' t stay up for more than minutes. It turned out that the firmware version activated IPSec offloading to the NPs. As your 50B doesn' t have NPs but the 200B does, it might be that offloading causes your troubles. There are CLI commands to disable offloading which might be worth trying (conf system npu). Fortinet TAC should be able to help you in this direction.

[#10]

Hello ede_pfau, I can not downgrade because the FortiGate 50B only supports 20 tunnels. I do not complain to the problem with the vpn, because the problems in this work are ordinary but for the assistance. They could not tell me that there are problems and are solving them, rather than bounce the problems? I pay a regular service, and i do not accept that support will not answer me for 1 week otherwise why I must pay the service? Thanks for your reply, after I try to apply your suggestion, and I' ll let you know.