IPsec VPN load balancing troubleshooting

Use the following commands to verify that IPsec VPN sessions are up and running.

Use the diagnose load-balance status command from the primary FIM to determine the primary FPM. For FortiGate-7000 HA, run this command from the primary FortiGate-7000. The third line of the command output shows which FPM is operating as the primary FPM.

diagnose load-balance status
==========================================================================
Slot: 2  Module SN: FIM21FTB21000042
  Master FPM Blade: slot-3
 
     Slot  3: FPM20FTB21900053
       Status:Working   Function:Active
       Link:      Base: Up          Fabric: Up
       Heartbeat: Management: Good   Data: Good
       Status Message:"Running"
     Slot  4: FPM20FTB21900065
       Status:Working   Function:Active
       Link:      Base: Up          Fabric: Up
       Heartbeat: Management: Good   Data: Good
       Status Message:"Running"
 
==========================================================================
Current slot: 1  Module SN: FIM21FTB21000015
  Master FPM Blade: slot-3
 
     Slot  3: FPM20FTB21900053
       Status:Working   Function:Active
       Link:      Base: Up          Fabric: Up
       Heartbeat: Management: Good   Data: Good
       Status Message:"Running"
     Slot  4: FPM20FTB21900065
       Status:Working   Function:Active
       Link:      Base: Up          Fabric: Up
       Heartbeat: Management: Good   Data: Good
       Status Message:"Running"

Log into the primary FPM CLI and from here log into the VDOM that you added the tunnel configuration to and run the command diagnose vpn tunnel list name <phase2-name> to show the sessions for the phase 2 configuration. The command output shows the security association (SA) setup for this phase 2 and all of the destination subnets and the FPM this SA was assigned to.

From the command output, make sure the SA is installed and the dst addresses are correct. The IPsec LB line shows that the tunnel is terminated on FPM6.

CH15 [FPM04] (002ipsecvpn) # diagnose vpn tunnel list name to-fgt2
list ipsec tunnel by names in vd 11
------------------------------------------------------
name=to-fgt2 ver=1 serial=2 4.2.0.1:0->4.2.0.2:0
bound_if=199 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/40 options[0028]=npu ike_assit 
proxyid_num=1 child_num=0 refcnt=8581 ilast=0 olast=0 auto-discovery=0
ike_asssit_last_sent=4318202512
stat: rxp=142020528 txp=147843214 rxb=16537003048 txb=11392723577
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=2
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=to-fgt2 proto=0 sa=1 ref=8560 serial=8
  src: 0:4.2.1.0/255.255.255.0:0 0:4.2.2.0/255.255.255.0:0
  dst: 0:4.2.3.0/255.255.255.0:0 0:4.2.4.0/255.255.255.0:0 0:4.2.5.0/255.255.255.0:0
  SA: ref=7 options=22e type=00 soft=0 mtu=9134 expire=42819/0B replaywin=2048 seqno=4a26f esn=0 replaywin_lastseq=00045e80
  IPsec LB: esp_worker=FPM06 esp_assist_last_sent=4295272912
  life: type=01 bytes=0/0 timeout=43148/43200
  dec: spi=e89caf36 esp=aes key=16 26aa75c19207d423d14fd6fef2de3bcf
       ah=sha1 key=20 7d1a330af33fa914c45b80c1c96eafaf2d263ce7
  enc: spi=b721b907 esp=aes key=16 acb75d21c74eabc58f52ba96ee95587f
       ah=sha1 key=20 41120083d27eb1d3c5c5e464d0a36f27b78a0f5a
  dec:pkts/bytes=286338/40910978, enc:pkts/bytes=562327/62082855
  npu_flag=03 npu_rgwy=4.2.0.2 npu_lgwy=4.2.0.1 npu_selid=b dec_npuid=3 enc_npuid=1

Log into the CLI of any of the FIMs and run the command diagnose test application fctrlproxyd 2. The output should show matching destination subnets.

diagnose test application fctrlproxyd 2 fctrlproxyd route dump : 
 
7KF-CH10 [FIM01] (global) # diag test application fctrlproxyd 2
 
fcp IKE routes:
en:0 slot:01 vd:003 t_type:auto dst:4.3.1.0/24, p1-vlan91-a
en:0 slot:01 vd:004 t_type:auto dst:4.2.1.0/24, p1-vlan91-b
en:0 slot:01 vd:005 t_type:auto dst:4.12.5.0/24, FGT1_to_FGT2
en:0 slot:01 vd:005 t_type:auto dst:4.12.8.0/24, FGT1_to_FGT4
en:0 slot:01 vd:069 t_type:auto dst:34.1.4.0/24, p1_v3011
en:0 slot:01 vd:069 t_type:auto dst:34.1.8.0/24, p1_v3013v6
en:0 slot:01 vd:071 t_type:auto dst:34.3.4.0/24, p1_v3031
en:0 slot:01 vd:073 t_type:auto dst:34.4.4.0/24, p1_v3041
en:0 slot:01 vd:073 t_type:auto dst:34.4.9.0/24, p1_v3047
en:0 slot:01 vd:075 t_type:auto dst:34.5.0.52/32, p1_v3055
en:0 slot:01 vd:107 t_type:auto dst:181.1.0.0/16, qd_ag1
en:1 slot:03 vd:075 t_type:dialup dst:34.5.66.201/32, p1_v3056
en:1 slot:07 vd:075 t_type:auto dst:34.5.4.0/24, p1_v3051
en:1 slot:07 vd:075 t_type:dialup dst:34.5.0.82/32, p1_v3058
en:1 slot:07 vd:075 t_type:dialup dst:34.5.0.92/32, p1_v3059
 
Statistics:
FIM01 FIM02 FPM03 FPM04 FPM05 FPM06 FPM07 FPM08 FPM09 FPM10 FPM11 FPM12
   11     0     1     0     0     0     3     0     0     0     0     0
total active routes: 4
total inactive routes: 11