https://kb.fortinet.com/kb/documentLink.do?externalID=FD33101 The ESP packet invalid error is due to an encryption key mismatch after a VPN tunnel has been established. When an IPSec VPN tunnel is up, but traffic is not able to pass through the tunnel, Wireshark (or an equivalent program) can be used to determine whether there is an encryption mismatch. A mismatch could occur for many reasons, one of the most common is the instability of an ISP link (ADSL, Cable), or it could effectively be any device in the physical connection. The following information is required to troubleshoot the problem. 1) Take a packet sniffer trace on both FortiGates. 2) Run the "diag vpn tunnel list” command a few times on both FortiGates when generating traffic that will pass through the tunnel. In the following example, the error message was seen on the recipient FortiGate: date=2010-12-28 time=18:19:35 devname=Kosad_VPN device_id=FG300B3910600118 log_id=0101037132 type=event subtype=ipsec pri=critica...
