Reference

https://community.fortinet.com/fortigate-3/technical-tip-ipsec-tunnels-not-connecting-after-upgrade-to-v7-6-5-or-above-220185

Scope

After 7.6.5

Situation

# IPsec預設DH group變更
The default IPsec DH group has changed starting with FortiOS 7.6.5.

Solution

[1]
Log in Fortigate GUI

[2]
# 檢查設定是不是預設值，Phase1要看、Phase2如果有開啟PFS也要注意DH Group
VPN > IPsec > edit tunnel

Check

# 清除舊的Filter設定
diagnose debug disable
diagnose debug reset
diagnose vpn ike log filter clear

# 過濾名稱
diagnose vpn ike log filter name "Tunnel_Name"

# 設定檢查項目
diagnose debug application ike -1

# 顯示日期
diagnose debug console timestamp enable

# 啟動debug flow
diagnose debug enable