Hi Everyone,   We're having trouble troubleshooting the site to site with Fortinet and ASA. Our firewall is ASA ASA5525. Few days ago we observed that the tunnel very often to went down,  even we refreshed the tunnel it won't bring up. And we need to initiate a traffic behind of our firewall ASA to lan (Tx Increment while Rx doens't increment) to behind of fortinet, after it a few seconds the tunnel will goes up. As follows is our phase 1 policy  crypto ikev1 policy 1 authentication pre-share encryption aes-256 hash sha group 5 lifetime 86400 Questions : I would like to understand why the tunnel always went down and  we need to initiate a traffic behind us? and  We don't see any problem with other site to site.  (Tx Increment while Rx doens't increment) As we initiate we're sending traffic that's why Tx incremented and why we're not receiving it? the fortinet doesn't responding to us? (that's why the Rx doesn't incrementing)  and after the initiating from us ASA proposed a policy 1 the tunnel will goes up again?  Regards, Ron ... View more

Hi Everyone, Just want to know what are the traffic passing in vPC peerlink?  and what the behavior of the traffic of orphan ports, they will pass through peer link ? Regards, Ronnie Billate ... View more

Hi All, The server are running in orphan ports and connected into two CSW1 and CSW2, anyone can comment on this design? For sample rtr that configured in vpc sometimes the router can see the 10.62.192.10 and  cannot reach the 10.62.192.11.  vice versa behavior.                  RTR           /        po1              \ /          vPC               \ N9k1 ---vpc --- N9k2  \                           /    \  __________  /   Orphan ports       | __ SERVER _|   10.62.192.10 10.62.192.11 ... View more

One router, Two Outside, One Inside, Two Outside public NAT in One inside IP. Any can help me, I trying to have a network with  - 1 router - 2 ISPs - two OUTSIDE - one Inside - all servers publicly have two NAT PUBLIC ISP. What I did is I configure IPsla, in case if the primary goes down it will fail over to secondary. But the problem comes in  The router have a configuration of  "ip nat inside source static private_IP public_isp1"   "ip nat inside source static private_IP public_isp2"  the problem is the NAT translation, if I shutdown the link of Public ISP1 (assumption the traffic will traverse to ISP2) NOW the default route is already in ISP 2.BUT in NAT TRANSLATION the router using the NAT subnet of ISP1, as resulting the packet starting to drop because the translated IP address is wrong (ISP1) that supposed to be using the static nat of ISP2.  ... View more