FORTINET IPSEC VPN MONITOR USERNAME MANUAL

For this particular customer, I may consider using the SDWAN VPN Zone config with performance SLAs testing connectivity between sites but I need to test it internally first. The Redacted info is either their real public IPs or routes to a federal agency.Īgain for this particular customer, they're running a full-mesh VPN topology with redundant ISPs at each site, unfortunately, the VPN traffic isn't failing over to the secondary tunnels because the first tunnel is still considered 'up'. I do have blackhole routes in place for those remote networks: S via 192.168.5.135, internalĬ is directly connected, wan1Ĭ is directly connected, wan2 is directly connected, K32-BB2, Ĭ 10.10.8.0/24 is directly connected,

Sure I can share the routing table(kinda): Routing table for VRF=0 I'm seeing an identical issue with other customers on other ISPs so the statement in the Fortinet doc regarding the ISP must be blocking ESP doesn't seem to apply, but I can confirm when the issue is happening ESP/proto 50 isn't showing in the debug flow until I bring the tunnel down and it restarts. This particular customer has ATT dedicated ethernet at both sites.

FORTINET IPSEC VPN MONITOR USERNAME MANUAL

Other than that, I'm just annoyed that the issue requires manual intervention. This allows to: - Set the number of results to unlimited (Show Top 0) in order to show all users. The VPN Event log doesn't seem to show any indication of when the tunnel entered a 'fake up' state. 1) In the selected dataset, test if the required data is available in the database: 2) Create custom chart, using the dataset ' vpn-Top-Dial-Up-VPN-Users-By-Duration ' or ' vpn-Authenticated-Logins '. I'm not using an SDWAN zone for the VPN, and it's just static routing between the sites. The VPN config is simple enough: config vpn ipsec phase1-interface I've just recently changed a specific customer to custom IKEv2 for their site to site tunnels as were previously using the OCVPN and having the same issues. The only resolution seems to be just selecting the Phase2 tunnel in the IPsec monitor and bringing it down, which after a refresh shows that the tunnel is up again and traffic is flowing immediately. I've seen it on FortiOS 6.0.9 up to 6.4.2. There doesn't appear to be any resolution for this particular issue it seems.

The IPsec monitor is showing that the connection is up, and I can reset the tunnel statistics and watch both the Incoming and Outgoing Data usage start counting up, but traffic never reaches the destination. Every so often, a customer will call in and tell us they're unable to reach a location over their site-to-site VPN. I've got a strange issue I've seen with a few customers on multiple different ISPs.

Fortinet ipsec vpn monitor username