VPN Gateway Azure: Déconnexions récurrentes avec envoi de DELETE IKE phase 1

chenouili 0 Reputation points
2026-10-13T13:35:59.52+00:00

Description du problème

Je rencontre des déconnexions régulières sur deux tunnels IPsec Site-to-Site entre une Azure VPN Gateway et des équipements FortiGate. La Gateway Azure envoie des messages DELETE IKE phase 1, ce qui semble provoquer la perte de connectivité.

Environnement

Service concerné : VPN Gateway ; Architecture : Azure VPN Gateway avec deux connexions IPsec vers deux équipements FortiGate ; Région non précisée.

Ce que j’ai déjà essayé

J'ai vérifié la cohérence des paramètres de configuration, notamment les phases IKE et IPsec, ainsi que la topologie. J'ai également effectué des resets de session sur les connexions concernées. Cependant, les déconnexions persistent.

État actuel

Je cherche à comprendre la cause de ces déconnexions récurrentes et à obtenir des recommandations pour stabiliser la connexion, notamment en ce qui concerne le rekey IKE/IPsec et la configuration des gateways.

Azure VPN Gateway
Azure VPN Gateway

An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andriy Bilous 12,516 Reputation points MVP
    2026-10-14T04:56:27.5933333+00:00

    Hello chenouili

    An IKE Phase 1 DELETE message sent by Azure does not necessarily indicate an Azure VPN Gateway issue. It can be part of normal Security Association (SA) expiration, rekeying, Dead Peer Detection (DPD), or gateway failover.

    Azure VPN Gateway uses a fixed IKE Phase 1 lifetime of 28,800 seconds (8 hours), which cannot be modified.

    Verify in your end:

    1. Identify the disconnection interval. If tunnels disconnect approximately every 8 hours, investigate Phase 1 rekeying first. Compare the FortiGate Phase 1 lifetime and rekey timing with Azure's fixed lifetime.
    2. Verify IKE/IPsec settings: IKE version, encryption/integrity algorithms, DH/PFS groups, Phase 2 lifetime, and traffic selectors. Both peers must have compatible settings.
    3. Check DPD and network stability. Azure recommends a DPD timeout of approximately 30–45 seconds. Also verify UDP 500/4500 connectivity and NAT-T behavior.
    4. Enable Azure VPN Gateway diagnostic logs, especially IKEDiagnosticLog and TunnelDiagnosticLog, and correlate the exact disconnect timestamps with FortiGate IKE debug logs. This helps distinguish failed rekeying, DPD timeouts, and Azure gateway failover.

    Do not assume that Azure caused the failure simply because FortiGate received a DELETE message. The preceding IKE exchanges and Azure diagnostics are needed to determine why the SA was deleted.

    If both FortiGate tunnels disconnect simultaneously, also investigate Azure gateway maintenance/failover and any shared network dependencies.

    If the logs show Azure initiating unexpected DELETE messages without SA expiration, DPD failure, or failover, open an Azure VPN Gateway support request with the exact UTC timestamps and correlated logs.

    Official Microsoft documentation:

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.