Site-to-Site GRE tunnel fails after about 5 mins

[cromsos]

Hi,  I've built a site to site GRE tunnel between an HA pair of Fortigate 101F devices (Firmware: 7.4.3build2573) to a remote site with a Debian 12 server acting as a gateway device using the following publications as a guide:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-and-verifying-a-GRE-tunnel-bet...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-GRE-Tunnel-monitoring/ta-p/197720

The tunnel starts passing traffic as soon as I add the static routes and incoming and outgoing FW policies.  The tunnel will continue to pass traffic for about 5 minutes then fail.

I've traced the issue to the Fortigate equipped site.  If I ping a host in my local network from the remote site I can observe the following:

(1) I see the a protocol 47 packet arrive on the "wan1" interface of my Fortigate.

(2) I see the unencapsulated ICMP request cross the "Site_To_Site" tunnel interface on the Fortigate.

(3) I see the unencapsulated ICMP response come back across the "Site_To_Site" tunnel interface.

(4) The packet, is then gone, it never gets encapsulated and passed across wan1 to the remote site.

Similarly, if I initiate a ping from inside my local site to a host at the remote site I see #3, then nothing across the wan (#4).

Nothing in the system event or security event logs at all.

Topology:

Local Site Subnets

172.16.0.0/16 ---- FG101F HA Cluster (wan1: 10.129.222.101)--(Site-to-Site: 172.16.0.1/32)

                                                                                                                                   |

                                                                                                                         Site_To_Site

                                                                                                                                   |

172.20.0.0/16 ---- Debian 12 Cluster (enp48s0f0: 10.129.192.62)--(tun0: 172.16.0.2/32)

Remote Site Subnets

Local Forti GRE Tunnel Config:

taani-fw1 (gre-tunnel) # show
config system gre-tunnel
edit "Site_To_Site"
set interface "wan1"
set remote-gw 10.129.222.101
set local-gw 10.129.192.62
next
end

Local Forti GRE interface config:

edit "Site_To_Site"
set vdom "root"
set ip 172.16.0.1 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 172.16.0.2 255.255.255.255
set snmp-index 35
set interface "wan1"
next

Local Forti outgoing GRE Policy

config firewall policy
edit 27
set name "toECC"
set uuid 3ecdc5f4-e874-51ee-603a-dfeed7873c2e
set srcintf "VLAN40" "VLAN30" "VLAN50" "VLAN60" "VLAN70" "VLAN230"
set dstintf "Site_To_Site"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
next
end

Local Forti Incoming Policy

config firewall policy
edit 28
set name "fromECC"
set uuid 62e8f5d0-e874-51ee-fa87-c2bbd577c879
set srcintf "Site_To_Site"
set dstintf "VLAN30" "VLAN40" "VLAN50" "VLAN60" "VLAN70" "VLAN230"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
next
end

Local Static Routes:

config router static
edit 1
set gateway 10.129.192.1
set device "wan1"
next
edit 2
set dst 172.20.0.0 255.255.0.0
set distance 1
set device "Site_To_Site"
next
edit 3
set status disable
set dst 10.129.222.101 255.255.255.255
set distance 1
set blackhole enable
set vrf 0
next
end

Note - Once the tunnel fails, nothing I do seems to bring it back.  I have to tear everything down on the local side and reconfigure.  Each time I do that, I get the same result - up for a short time then "poof".

Any thoughts?  Thanks in advance - Chris

[AEK]

Hello

It's not the first time I see GRE issue between two different editors. Last one I've seen just few days ago is GRE between Cisco and Sophos.

Although GRE is simple to configure and "I guess" standard, but seems like editors are not always compatible with each others in GRE.

You may check the below, just in case you missed something from FG side.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-and-verifying-a-GRE-tunnel-bet...

In case you couldn't fix it, think about using IPsec for better security.

[cromsos]

Thank you for the reply.  I hadn't considered a compatibility issue between Fortigate and Debian.  I actually started with IPsec but ran into a roadblock on the Debian Strongswan (remote) side with policy based routing.  I'll likely go back to that.  Wish wireguard was a option on the Fortigate. 

GRE was a really attractive option across the private network that both devices are in.

[AEK]

Hope this helps with IPsec/Strongswan.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Site-to-Site-VPN-with-Strongswan...

https://community.fortinet.com/t5/Support-Forum/Ipsec-connection-in-linux-mint-with-strongswan/m-p/3...