Please ensure the phase 2 lifetimes are equal on both ends of the tunnel whenever possible. While MX's can sometimes honor a shorter phase 2 lifetime if they're acting in response to build a tunnel, they cannot while serving as the initiator of the tunnel.
Phase 1 (IKE): 28800 seconds (8 hours)
Phase 2 (IPsec): 3600 seconds (1 hour)
Fortigate often uses similar defaults, but if they differ, the tunnel may drop after one side expires the SA and the other doesn’t rekey properly.
Make sure both devices have the same lifetimes for Phase 1 and Phase 2.
If DPD is disabled or misconfigured, the tunnel may stay in a “dead” state after one side loses connectivity.
On Fortigate, set dpd enable
https://community.fortinet.com/t5/FortiClient/Technical-Tip-Configuring-DPD-dead-peer-detection-on-I...
On Meraki, DPD is enabled by default, but verify under VPN settings.
I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.
Please, if this post was useful, leave your kudos and mark it as solved.
