Technical Tip: Ping Traffic not working between End Machines via IPSec Site-Site Tunnel

Toplogy:

Local Subnet ---> FortiGateA <--> IPSec Site-Site <--> FortiGateB ---> Remote Subnet

Observations:

• The IPSec Site-Site configuration is appropriately configured on both the FortiGate devices with relevant Firewall Policies and Routes for Local and Remote Subnets
• It can be seen that the Ping traffic is successfully processed by both the FortiGate between Local and Remote machines. However, there would be a 'Request timed out' in the Command prompt.
• In the Flow Debug and Sniffer outputs, it can be seen that the Ping Traffic is flowing in and out of both the FortiGate through corresponding Firewall Policies however, there will be no response from the end machines.

Solution:

• Disable Windows Firewall and AntiVirus (optionally) Or, implement the steps below to create a Custom rule in Windows Defender Firewall with Advanced Security:

1. Log in to the Windows machine.
2. Go to Windows Defender Firewall and select Advanced Settings.
3. On the Windows Firewall with Advanced Security screen, select Inbound Rules and select the New Rule link located at Actions Pane.

4.  Select Custom and then select 'Next'.

5. Select All programs, then on Next.

6. Select the Protocol type as ICMPv4 and click on the Customize button.

7. On the next screen, select Specific ICMP types and then Echo Request. Select 'OK', and then Next.

8. Select either Any IP address or These IP Addresses under the 'Which local IP addresses does this rule Apply to?' and 'Which Remote IP addresses does this rule Apply to?' Options. When selecting These IP addresses, specify the IP addresses to be allowed.

9. Once the necessary settings are done, select the Next button.
10. On the next screen, Allow the Connection and Next.

11. On the next screen, select the profile name (Domain, Private, Public) to which this rule should be applied, and then select Next.

12. On the next screen, type the name of the rule and specify the description (optional). Select Finish.

Note:
By default, the ICMPv4-In rule only allows for local subnet only. In order for ping traffic to work, enable NAT on policy or change to scope to 'Any'.