Hi everyone, new to FortiGate and this community. I’ve set up a site-to-site IPSec VPN between our main office (FortiGate 60F) and a remote site. It establishes fine, but the tunnel drops exactly every 24 hours. It reconnects automatically, but the interruption is disruptive.
Our phase 2 lifetime is set to the default 3600 seconds. Could this 24-hour cycle be from a phase 1 setting I’m missing? Or is there a common scheduler or key refresh timer I should check? Any pointers on where to look in the config would be really appreciated.
?^?
Still learning.
The phase 2 lifetime won't cause a 24-hour cycle. That's your hour-long rekey. The 24-hour pattern is almost always a scheduled policy or a key lifetime you missed. Check your phase 1 configuration for a 'lifetime' setting, it's probably 86400 seconds. Vendors love burying that default. Also, look for any security policy scheduler tied to the VPN, even a diagnostic one. It's surprising how often the 'solution' is a feature someone turned on without understanding the consequences.
Oh, that's a great point about the scheduler. I manage our team's collaboration tools and sometimes a teammate will turn on a "weekly sync" feature without realizing it runs 24/7.
Where would you typically find a policy scheduler tied to the VPN? Is it on the firewall policy page itself, or more hidden? Trying to learn what I'd look for if this ever happens with our setup.
That default lifetime buried in phase 1 is a classic trap. I once saw a similar thing happen in a cloud pipeline where a default 24-hour token refresh was bringing down a sync job.
When you mention a policy scheduler, could that be under a completely different menu, like a diagnostic or report feature? Sometimes the "auto-refresh" settings for logs or traffic reports get misinterpreted as operational controls.
null
Check the dead peer detection interval. Fortinet calls it DPD. If that's set too aggressively on both ends, it can cause clean renegotiation that looks like a scheduled drop. Seen it happen with mismatched timeouts between vendors.
Phase 1 lifetime at 86400 seconds is the usual suspect, like others said. But also look at any logging or report generation jobs. Some boxes have a daily log rollover that momentarily flushes sessions.
Trust but verify.
You're absolutely right about DPD. I've seen exactly that with a mixed vendor setup where a Palo on one side had DPD disabled by default, but the FortiGate on the other side was sending probes. The tunnel would stay up, but every 24 hours it'd trigger a full renegotiation that looked just like a scheduled drop.
It's one of those things that's easy to miss because it's working, just in a weird way. A quick check in the CLI with `diagnose vpn ike gateway list` can show you if there are DPD mismatches. Sometimes the fix is just forcing DPD to 'on-demand' instead of periodic.
Automate all the things.