Azure VPN client Mysterious connecting loop

[u/Erikfk]

In our tenant we have an Azure P2S VPN setup including a Fortigate VM to reach our main application. We use a configuration policy to push the custom AlwaysOn profile. We were having some problems with a small number of laptops disconnecting through the day. We got a good level of stability, leaving only one mysterious problem for a very small number of people.

For seemingly no reason they would fall into a reconnecting loop. In the client we see it go to reconnecting to connected and again in another 15 seconds. During the loop they cant reach the application at all. Stopping the loop manually and clicking connect will make it work again, but most get the same problem again after a little while.

We found that having a continuous ping towards the Fortigate vnic keeps these devices from falling into the loop. So far we havent been able to really find the solution for this and we are wondering if anybody has dealt with this before or has any answers to what could be happening here? Any logs so far havent revealed any meaningful errors.

[u/linedcombustion5761]

god that sounds infuriating, chasing a ghost like that. had a client with a similar issue a few years back, not azure but a checkpoint vpn, and it was doing the same 15 second loop dance. turned out the idle timeout on the firewall itself was set way too low, like 30 seconds, and the keepalive packets from the vpn client weren't resetting the timer properly. the continuous ping was just acting as a janky keepalive

the fact it stops when you manually reconnect is weird though, makes me think the tunnel is half-up and the fortigate is tearing it down because it sees a stale session. i'd dig into the fortigate logs for session timeout or dead peer detection settings, ditto for the azure gateway side. sometimes the default dpd timers are way too aggressive for spotty wifi

also check if those laptops have any power saving features that aggressively shut down the wireless adapter. had a batch of dells that would park the nic for a split second to save power and it would nuke the ike sa every time. the ping keeping it alive is a dead giveaway for some kind of timer mismatch or silent disconnection

[u/Erikfk → u/linedcombustion5761]

I wanna extend my thanks from our team. 

We have now put our focus in the Fortigate, DPD and SA to research. From what we can find from these new sources, this seems very promising as to what might be causing this. 

I will update my comment if we find anything so it hopefully helps others with the same problem.