ipsec tunnel fails, doesn' t autorecover but psk hack does the trick

[journeyman]

Third in a series of posts on nat traversal ipsec tunnels. So far the faults have been port forwarding errors on my part; here' s the previous installment. Six tunnels are working. All are via 3G nat-t. Two in particular have a tendency to randomly fail and not recover (however they also run for days at a time). These two are geographically " related" (rural area, tens of km). Their failure isn' t the problem if only they would restore. Getting these two to restore automatically is the question. This kludge works: the simplest way I know to fix a broken tunnel is to edit the remote psk to a known bad value, wait a minute then restore the psk to the correct value. Bingo, the tunnel comes up immediately and ospf is established. All is well until the next failure. Discovered by accident, it' s hardly a good way to fix it. It raises the question what is wrong and why does this work? I have tried to use

 diag vpn ike gateway clear
 diag vpn tunnel reset

When the commands are executed at the remote this is not effective. Using

 diag ike gateway list 
 diag vpn tunnel list

I see that the reset commands do something, but obviously not enough. Also diag vpn ike gateway clear ph1-name returns code -61 (4.3.12) even though autocomplete says the syntax is correct? There are firmware mismatches (urg, the bane of my existence) but I doubt this is the issue. However the central is 4 MR1 so doesn' t have the same diags. I don' t want to reset all tunnels here. Any thoughts?

[ede_pfau]

Sounds like rekeying isn' t set up properly. By putting in a bad PSK the SA on the central side is deleted, and then re-establishing the tunnel works. I know you will see this coming, but anyway...FOS 4.1 R-I-P! Without touching the central FGT you will not get to grips with this. Update to 4.3.17 and see how this goes. Check the " autokey" settings on both sides as well.

[journeyman]

to achieve the same thing without the above hack, try the following at the remote end

diag vpn ike restart