IkeV2 IPSEC-crash during HA failover after upgrade to 7.0.14

[hdoforumusr]

We have an SDWAN with a hub spoke setup, running on IPSEC tunnels with IkeV2.

After upgrading the hub firewall to 7.0.14, a majority of the tunnels crashed minutes after an HA failover (first time during the actual upgrade).

- Tested with same result on both 1101e and 200e.

- The crash does not occur immediately, but a few minutes after.

- It only affects dynamic tunnels on the firewall, but not all (seems random which goes down and not).

- Tunnels came up again after DPD timeout and re-negotiation.

- Static tunnels on the same firewall is ok (with ikeV1 though).

- Some spokes lost both tunnels (on different carriers), some lost one, some lost none.

- Have not seen any pattern regarding SW-version on spokes

Fortinet has confirmed similar reported issue in our ticket and that a fix will be released with 7.0.15 (also available in 7.2.6 and above), but I haven`t been able to fid any official information describing the problem.

Has anyone experienced similar problems or have information about this issue?

[hbac]

Hi @hdoforumusr,

Can you make sure that the following settings are enabled:

• session-pickup under HA settings.
• ha-sync-esp-seqno under IPsec phase1-interface settings.

Can you also provide the crashlog by running this command 'di deb crashlog read'. 

Regards, 

[hdoforumusr]

Hi,

Both settings enabled.

There are no events from relevant time stamps in the crashlog