Intermittent VPN Drops Under Load
A dial-up IPsec VPN for 40 remote workers drops randomly during business hours. Logs show 'IPsec phase 2 negotiation' repeats and some tunnels re-establish every few minutes. The FortiGate is a 60F; CPU sits near 70% at peak, and the WAN link is 200/50 Mbps with bufferbloat during large uploads. Phase 1 uses default lifetimes, DPD on-idle, and aggressive mode is disabled. Remote users are on dynamic public IPs behind consumer NAT. You must reduce disconnects without buying hardware.
1. What are the two most probable technical causes of the repeated phase 2 renegotiation, and how do you differentiate them?
Read the worked answer
Two prime candidates:
- Phase 2 lifetime / rekey collisions with NAT-T and many peers - default phase 2 lifetime (seconds) expiring, and with 40 dynamic peers the rekey bursts coincide, causing drops if the device is CPU-constrained. Differentiate: check logs for rekey at regular intervals (matching the lifetime) vs random times.
- DPD false positives under bufferbloat - during large uploads, DPD on-idle probes are delayed/dropped, so the FortiGate tears down tunnels it thinks are dead. Differentiate: correlate drop timestamps with upload spikes and look for DPD timeout messages rather than clean rekeys.
A third check: NAT-T keepalive/port mapping changes on consumer NAT. Confirm by comparing drop times to NAT rebind events. Use diagnose vpn ike gateway list and diagnose vpn tunnel list during an event to see which side initiated teardown.
2. Given the constraints, propose concrete configuration changes to stabilize the tunnels.
Read the worked answer
Prioritized, no-new-hardware changes:
- Extend phase 2 lifetime (e.g., to a longer value) to reduce rekey frequency and burst load; stagger by not letting all peers share the exact same value if possible.
- Tune DPD: switch from on-idle to on-demand, or increase the retry interval/count so transient bufferbloat doesn't kill tunnels. Avoid aggressive DPD on lossy consumer links.
- Enable NAT-T keepalive and ensure
set nattraversal enable; consumer NAT mappings expire otherwise. - Address bufferbloat: apply a traffic shaper to the WAN egress to cap bulk uploads (e.g., shape to ~45 Mbps) so DPD/ISAKMP packets aren't starved.
- Reduce CPU pressure: offload where supported, review UTM on the VPN policy (heavy inspection on 40 tunnels on a 60F is costly), and consider splitting inspection.
Validate with diagnose vpn tunnel list stability and log correlation after each change, one variable at a time.