I have Tunnel VPN IPSec site to site with SAP in cloud and the tunnel turn down if no trafic .I'm not able to turn it up from my side. when SAP do ping the tunnel turn UP.
please any idea in this issue.
for help:
My FGT is route based and SAP have Cisco and is Policy Based
please any help
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I could be bold and ask "and what?"...why is that a problem, is traffic from your side not passing the tunnel if it's become down? You didn't mention.
What you can do to check: only traffic matching the phase2 descriptors will open negotiations on the tunnel. From what you mention I assume that the tunnel goes down because of idle timeout, i.e. no traffic for a while.
I personally don't think that keeping a tight idle schedule is a good idea at all. But, if the other side sets a shorter idle timeout interval than your side, the shorter one will win. So you cannot influence that (other than negotiate with the SAP side).
But you could keep the tunnel busy all the time, by pinging the remote side's server, or gateway. I know you can disallow ping but that is neither safe nor clever.
If that doesn't work, check your phase2 settings, tweak the idle time parameter and see to it that traffic is passing which is mentioned in the selectors.
You could inform us in which way you try to "revive" the tunnel, sourcing from which network?
Hi @Waloo5,
If you want to the tunnel to always be up, you can enable auto-keepalive. Please refer to this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-IPSec-auto-negotiate-and-keepali...
Regards,
here is the configuration I have in my side:
config vpn ipsec phase1-interface
edit "SAP"
set interface "port1"
set ike-version 2
set local-gw 192.168.1.2
set peertype any
set net-device disable
set proposal aes256-sha384
set dhgrp 20
set remote-gw X.X.X.X
set psksecret ENC XXXXXX
next
end
config vpn ipsec phase2-interface
edit "SAP"
set phase1name "SAP"
set proposal aes256-sha256
set dhgrp 20
set auto-negotiate enable
set src-addr-type name
set dst-addr-type name
set keylifeseconds 3600
set src-name "LAN_NETWORK"
set dst-name "SAP NETWORK"
next
end
My problem is that the communication is initiated from my side and when the tunnel is down I'm not able to bring it UP. I don't know why
So, in phase1 the following parameter is not shown, meaning that it is set to it's default value:
set idle-timeout disable
If you experience tunnel down if idle then the Cisco side will enforce this. Thus, you will not have much influence on this. (There is no mismatch between both firewalls.)
BTW, 'auto-keepalive' governs the key renegotiation. It is set correctly.
I think at this point we don't know the reason why the tunnel goes down, be it idle timeout or key timeout. You will find log messages for the correct reason.
Then, you will have to contact your SAP service supplier, to get this sorted out. As I don't see a single point in your config which we could pinpoint.
Hi,
in VPN events this what I have when the tunnel turn to Down
1.
Log Description | IPsec DPD failed |
Action | dpd |
Status | dpd_failure |
2.
Log Description | IPsec connection status changed |
Action | tunnel-down |
3.
Log Description | IPsec phase 2 status changed |
Action | phase2-down |
4.
Log Description | IPsec phase 1 SA deleted |
Action | delete_phase1_sa |
5.
Log Description | Progress IPsec phase 1 |
Action | negotiate |
Status | success |
Result | OK |
After it's still in boucle of success in negotiate phase 1.
I have now configured Link monitor to have countinious ping in tunnel, but not sure it's good idea
config system link-monitor
edit "SAP_MON"
set srcintf "SAP"
set server "SAP_IP"
set source-ip LAN_IP
set interval 5000
next
end
Please have a look at this:
Technical-Tip-Configuring-DPD-dead-peer-detection-on-IPsec-VPN
I think the default is "on-idle". Disable DPD on your side and observe.
Besides, DPD as implemented by Cisco may or may not be compatible with FortiOS's.
Hi,
My config on DPD is On Demand, and as you say I will disable DPD in my side and see.
Best regards,
Hi,
PS: I did it but the tunnel turn down after
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1673 | |
1083 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.