Professional Documents
Culture Documents
Connectivity:-
This document describes how to troubleshoot basic IPsec tunnel issues and understand
how to collect data required by TAC to investigate the VPN issues.
Use the following steps to assist with resolving a VPN tunnel that is not active or passing
traffic.
Solution
FortiOS supports:
- Site-to-Site VPN.
- Dial-Up VPN .
Phase-2 status can be found from both GUI and Command Line.
From GUI:
From CLI:
# Execute the command '# diagnose vpn tunnel list name <phase2-name>' <-----
To view the phase2 status for a specific tunnel.
['# diagnose vpn tunnel list' , can also be executed to view the phase2 status of all
tunnels ].
Execute the command '# diagnose vpn tunnel list name <phase2-name>' <----- To
view the phase2 status for a specific tunnel.
['# diagnose vpn tunnel list' , can also be executed to view the phase2 status of all
tunnels ].
Step 4: Analyze the IKE phase 1 messages on the responder for a solution.
[Phase 1 not up].
Checklist:
- Make sure if IKE traffic on port 500/4500 is allowed in the network device connected
upstream
GUI:
CLI:
4) If is possible to see traffic on port 500/4500 the follow the steps below to
troubleshoot this issue:
a) Run below commands(on receiver) to capture the IKE logs and initiate tunnel/traffic
from the remote end.
Note: Try to run the packet capture and the logs at the same time.
If VDOMs is enabled, make sure to be in the VDOM context and then execute the above
commands.
Checklist:
1) Confirm if the Encryption and Hashing algorithms match on both receiver and
initiator.
2) Check if PFS is enabled, if yes, make sure the configuration is matched on both the
units.
3) Make sure, if the quick mode selectors (interesting traffic) is matching on both units.
4) If Phase-2 is still not up, run the packet capture on port 500/4500 and run the below
commands,
# diagnose vpn ike gateway list (or diagnose vpn ike gateway list name
<tunnel-name>)
# diagnose debug console timestamp enable
# diagnose debug application ike -1
# diagnose debug enable
Note: If VDOMs is enabled, make sure to be in the VDOM context and then execute the
above commands.
Once the tunnel is up, traffic will be encapsulated in ESP (Encapsulating Security
Payload) protocol and sent to the remote peer.
Checklist:
1) Make sure the quick mode selector defined in Phase2 is configured properly to allow
the traffic flow, which is having the issue.
For example:
a) Enable packet capture for remote peer’s ip address and set protocol to 50(ESP).
b) Open two SSH session and run the below commands:
SSH session 1:
Note other protocol numbers can used as well for example OSPF(89).
SSH Session 2:
# diagnose vpn tunnel list (or # diagnose vpn tunnel list name
<phase2_tunnel_name> ).
Note: If VDOMs is enabled, make sure it is not in the VDOM context and then execute
the above command.
Make sure to collect packet capture and the logs mentioned above around the same and
attach it to the Fortinet case updates.
Along with this information, attach network topology (if any).
With this information, TAC will try to decrypt the ESP traffic in Wireshark.
If the remote peer is FortiGate as well, take packet capture on this unit as well which will
make sure that this unit received the encrypted traffic or if it was lost in the middle.
Checklist:
Note: If VDOMs is enabled, make sure it is not in the Global context and then execute
the above commands.
c) Was the VPN stable for a period of time and now it is going up and down?
- Yes - Investigate for network or unit changes or if any new network equipment has
been added to the environment. If so, confirm changes/additions are correct.
- No, Collect logs and packet capture as mentioned on Step 4
Make sure to collect packet capture and all the logs mentioned above around the same
and attach it to the Fortinet case updates.
Along with this information, attach network topology (if any). With this information, TAC
will investigate this issue.
Checklist:
SSH Session 1:
SSH Session 2: