VPN IPSec with SAP

[Waloo5]

I have Tunnel VPN IPSec site to site with SAP in cloud and the tunnel turn down if no trafic .I'm not able to turn it up from my side. when SAP do ping the tunnel turn UP.

please any idea in this issue.

for help: 

My FGT is route based and SAP have Cisco and is Policy Based

please any help

[ede_pfau]

I could be bold and ask "and what?"...why is that a problem, is traffic from your side not passing the tunnel if it's become down? You didn't mention.

What you can do to check: only traffic matching the phase2 descriptors will open negotiations on the tunnel. From what you mention I assume that the tunnel goes down because of idle timeout, i.e. no traffic for a while.

I personally don't think that keeping a tight idle schedule is a good idea at all. But, if the other side sets a shorter idle timeout interval than your side, the shorter one will win. So you cannot influence that (other than negotiate with the SAP side).

But you could keep the tunnel busy all the time, by pinging the remote side's server, or gateway. I know you can disallow ping but that is neither safe nor clever.

If that doesn't work, check your phase2 settings, tweak the idle time parameter and see to it that traffic is passing which is mentioned in the selectors.

You could inform us in which way you try to "revive" the tunnel, sourcing from which network?

[hbac]

Hi @Waloo5,

If you want to the tunnel to always be up, you can enable auto-keepalive. Please refer to this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-IPSec-auto-negotiate-and-keepali...

Regards, 

[Waloo5]

Hi @hbac @ede_pfau ,

here is the configuration I have in my side:

config vpn ipsec phase1-interface
edit "SAP"
set interface "port1"
set ike-version 2
set local-gw 192.168.1.2
set peertype any
set net-device disable
set proposal aes256-sha384
set dhgrp 20
set remote-gw X.X.X.X
set psksecret ENC XXXXXX
next
end
config vpn ipsec phase2-interface
edit "SAP"
set phase1name "SAP"
set proposal aes256-sha256
set dhgrp 20
set auto-negotiate enable
set src-addr-type name
set dst-addr-type name
set keylifeseconds 3600
set src-name "LAN_NETWORK"
set dst-name "SAP NETWORK"
next

end

My problem is that the communication is initiated from my side and when the tunnel is down I'm not able to bring  it UP. I don't know why

[ede_pfau]

So, in phase1 the following parameter is not shown, meaning that it is set to it's default value:

set idle-timeout disable

If you experience tunnel down if idle then the Cisco side will enforce this. Thus, you will not have much influence on this. (There is no mismatch between both firewalls.)

BTW, 'auto-keepalive' governs the key renegotiation. It is set correctly.

I think at this point we don't know the reason why the tunnel goes down, be it idle timeout or key timeout. You will find log messages for the correct reason.

Then, you will have to contact your SAP service supplier, to get this sorted out. As I don't see a single point in your config which we could pinpoint.

[Waloo5]

Hi,

in VPN events this what I have when the tunnel turn to Down

1.

Log Description

IPsec DPD failed

Action	dpd
Status	dpd_failure

2.

Log Description

IPsec connection status changed

Action

tunnel-down

3. 

Log Description

IPsec phase 2 status changed

Action

phase2-down

4.

Log Description

IPsec phase 1 SA deleted

Action

delete_phase1_sa

5. 

Log Description

Progress IPsec phase 1

Action	negotiate
Status	success
Result	OK

After it's still in boucle of success in negotiate phase 1.

I have now configured Link monitor to have countinious ping in tunnel, but not sure it's good idea

config system link-monitor
edit "SAP_MON"
set srcintf "SAP"
set server "SAP_IP"
set source-ip LAN_IP
set interval 5000
next
end

[ede_pfau]

Please have a look at this:

Technical-Tip-Configuring-DPD-dead-peer-detection-on-IPsec-VPN 

I think the default is "on-idle". Disable DPD on your side and observe.

Besides, DPD as implemented by Cisco may or may not be compatible with FortiOS's.

[Waloo5]

Hi,

My config on DPD is On Demand, and as you say I will disable DPD in my side and see.

Best regards,

[Waloo5]

Hi,

PS: I did it but the tunnel turn down after