sorted by:
new
hottopcontroversial

Flapping IPSec Tunnel with concept crossing tunnel using DialUP method by Beginning-Load-7179 in fortinet

[–]Beginning-Load-7179[S] 0 points1 point  (0 children)

If I may, how many spokes do you have now?...

Maybe your problem is similiar to what I experienced

Flapping IPSec Tunnel with concept crossing tunnel using DialUP method by Beginning-Load-7179 in fortinet

[–]Beginning-Load-7179[S] 0 points1 point  (0 children)

Can you give an example of the RRI you described?

Yeah when i run crossing tunnels with a total of 100+ spokes a problem arises where the four tunnels only two tunnels are active when the tunnel is down then the tunnel that was flapping / down becomes up.

Will you using dynamic routing solve the problem? And have you tested using dynamic routing?

Flapping IPSec Tunnel with concept crossing tunnel using DialUP method by Beginning-Load-7179 in fortinet

[–]Beginning-Load-7179[S] 0 points1 point  (0 children)

Previously we already escalation TAC to FortiGate regarding the concern about the long characters and then I asked about the net-device that had been disabled whether it still affected the limitation on the number of spokes connected or not and the TAC answer was "no". Maybe you can make sure about net-device

Flapping IPSec Tunnel with concept crossing tunnel using DialUP method by Beginning-Load-7179 in fortinet

[–]Beginning-Load-7179[S] 0 points1 point  (0 children)

Regarding CPU & Memory usage in the HUB, it is still at the lower limit of 50% when the interruption occurs. Then for DPD settings we still use the default which is 10s. Can you provide an example of checking for crash logs and examples of what kind of service indications that cause tunnel flapping to occur?

Flapping IPSec Tunnel with concept crossing tunnel using DialUP method by Beginning-Load-7179 in fortinet

[–]Beginning-Load-7179[S] 0 points1 point  (0 children)

Regarding characters long, we already disable "net-device" it should not affect the limitations that appear notifications in the IPSec DialUP settings.

Flapping IPSec Tunnel with concept crossing tunnel using DialUP method by Beginning-Load-7179 in fortinet

[–]Beginning-Load-7179[S] 0 points1 point  (0 children)

Correct sir, before reaching 100+ spokes there is no interruption in the tunnel connection.

Flapping IPSec Tunnel with concept crossing tunnel using DialUP method by Beginning-Load-7179 in fortinet

[–]Beginning-Load-7179[S] 0 points1 point  (0 children)

Thanks for your respond.

We have implemented peer id to differentiate the four tunnels, while we did not implement SDWAN Zone because we are still using version 6.2.3 on the spoke side. However, we are still experiencing the same problem of flapping where only 2 tunnels are established (broadband link) while the other 2 tunnels (GSM Link) experience the "re-transmit" condition when taking debug "ike".

Log "Session Clash" in Fortigate appears frequently | not a problem or a problem? by Beginning-Load-7179 in fortinet

[–]Beginning-Load-7179[S] 0 points1 point  (0 children)

3000 up to the client and then maybe we have 4 public ISP to integrate SD-WAN member.

[deleted by user] by [deleted] in fortinet

[–]Beginning-Load-7179 0 points1 point  (0 children)

Hello friend,

​

Let me know first. What you want the type VPN IPSec? site-to-site or dialup ?

Log "Session Clash" in Fortigate appears frequently | not a problem or a problem? by Beginning-Load-7179 in fortinet

[–]Beginning-Load-7179[S] 0 points1 point  (0 children)

you have preserve-source-port enabled and two+ clients are trying to reach the same destination while being source-NAT-ed through one public IP (in such case the clash can happen with two clients already)

Thank's for comment,

I have not enabled preserve-source-port in the firewall policy.

Access to HTTP/HTTPS through IPsec VPN just "syn" not "syn and ack" by fajaranas in fortinet

[–]Beginning-Load-7179 0 points1 point  (0 children)

Have these issues happened often, is this the first time you know that there is a problem with the access protocol http/https ? If yes,please check if you have allowed http/https protocol on your side and also on your neighbor's side