Troubleshooting intermittent IPsec dial-up VPN disconnections

1. Prepare persistent PuTTY logging. Open a PuTTY session to FortiGate and configure it to retain the output for later analysis. In PuTTY, go to Category > Logging, select All Session output, and choose the folder and file in which to save the session log. Use PuTTY rather than the FortiGate GUI CLI for long debug sessions because the GUI output can have incorrect formatting or the session can time out.

2. Start a FortiGate packet capture. Replace the placeholder with the public IP address of the affected host:

diagnose sniffer packet any " host <PublicIP of the Host getting disconnected> and port (500 or 4500) " 6 0 l

Run the packet capture and debug session at the same time. If the sniffer displays no packets, temporarily disable npu-offload under Phase 1. Guidance is available in Disabling NP offloading for individual IPsec VPN phase 1s.

3. Capture traffic on the affected host. Install Wireshark on the remote host and start a packet capture with a filter for the relevant IPsec signaling traffic. Select the interface through which VPN signaling traffic is sent. The source does not provide the capture-filter text.

4. Collect FortiGate IKE and authentication debug output. In the same logged PuTTY session, run:

diagnose vpn ike log filter clear
diagnose vpn ike log filter rem-addr4 <PublicIP of the Host getting disconnected>
diagnose debug console timestamp enable
diagnose debug application ike -1
diagnose debug application fnbamd -1
diagnose debug enable

The timestamps help isolate events when the known date and time of a disconnection are available. The IKE address filter limits output to the affected host. Starting with v7.4.1, diagnose vpn ike log filter dst-addr4 was changed to diagnose vpn ike log filter rem-addr4; use the command appropriate for the installed version.

5. Stop collection immediately after reproducing the issue. Press Ctrl+C to stop the FortiGate sniffer. Then stop and reset debugging:

diagnose debug disable
diagnose debug reset

6. Convert and analyze the captures. Convert the FortiGate sniffer output to PCAP by following How to import diagnose sniffer packet data to Wireshark. After capturing a disconnection successfully, follow Decrypt ESP packets to decrypt the ESP traffic. Correlate FortiGate and host captures by timestamp.

7. Review FortiGate VPN events. In the FortiGate GUI, go to Log & Report > System Events > VPN Events. Examine entries around the exact time of the disconnection for the termination reason and related events.

8. Collect FortiClient debug logs. Before attempting another VPN connection, enable the VPN module and select the debug log level in FortiClient. For complete endpoint-log analysis, use the FortiClient run diagnostic tool. For configuration details, refer to How to enable debug log in FortiClient or, for EMS-managed endpoints, How to enable debug log level on FortiClient endpoints managed by EMS.

9. Verify firmware compatibility. Check the relevant release notes to confirm that the installed FortiGate and FortiClient versions are supported together. For FortiClient 7.4.7, use Product integration and support.

10. Test without NPU offload. Because inbound IPsec traffic is normally offloaded to the NPU and this can sometimes contribute to disconnections, temporarily disable NPU offload under the affected Phase 1 and attempt to reproduce the issue. Use the individual Phase 1 procedure linked in step 2.

11. Check Phase 2 behavior. If the tunnel frequently goes down, inspect its Phase 2 settings and enable Autokey Keep Alive. See Using IPsec auto-negotiate and keepalive.

12. Inspect DoS policy processing. If a DoS policy exists on the specific interface to which the dial-up IPsec VPN is bound, verify its configuration. In the GUI, go to Log & Report > Security Events > Anomaly logs and determine whether the policy is incorrectly treating VPN traffic as a threat, which can cause intermittent disconnections or slowness. Supporting references are DoS policy on WAN interface can cause slowness and Denial of Service anomalies explained.

Reproduce the connection under observation and confirm that the tunnel remains stable. Correlate FortiGate sniffer output, Wireshark traffic, IKE and fnbamd debug messages, FortiGate VPN Events, FortiClient diagnostic logs, and Anomaly logs at the same timestamp. If testing a specific mitigation, verify stability after confirming version compatibility, disabling NPU offload temporarily, enabling Phase 2 Autokey Keep Alive, or correcting a DoS policy that was matching VPN traffic.

After the capture or isolation test, stop and reset FortiGate debugging with diagnose debug disable and diagnose debug reset. If NPU offload was disabled only for testing, restore the original Phase 1 NPU-offload setting after evidence collection. No other rollback procedure is provided.