Troubleshooting Tip: When a packet from a device behind an internal segmentation firewall was unable to reach a device across the internet or IPsec tunnel

A device behind the internal segmentation firewall might not be able to reach the destination device due to misconfiguration of NAT on firewall policy, or Phase II dropped the traffic of the IPsec tunnel because the source subnet(s) are not allowed through the VPN.

1. Ping commands on the Microsoft Windows command prompt along with sniffer on the FortiGate can be used to ensure that the traffic reaches the FortiGate's CLI via SSH or GUI and run the following commands:

diagnose sniffer packet any 'host w.x.y.z and icmp' 4 <----- w.x.y.z is the source IP address.

• Open the Windows command prompt and ping the destination device:

ping w.x.y.z <-- w.x.y.z is the destination IP address

• Check the output of the sniffer. If the packet did not reach the FortiGate, then ensure that the default gateway was set on the PC.

ipconfig /all

2. Run the same sniffer command on the upstream FortiGate and confirm if there is bidirectional traffic. If not, then use debug flow to gather more details.

    

diagnose debug reset

diagnose debug flow filter clear

diagnose debug console timestamp enable

diagnose debug flow show function-name enable

diagnose debug flow show iprope enable

diagnose debug flow filter addr w.x.y.z  

diagnose debug flow trace start 99

diagnose debug enable

Repeat the ping test from the PC and review the debug flow output. In some cases, the issue was due to a software firewall on the destination device. One way to confirm is to run sniffer and debug flow commands on the destination FortiGate.

Alternatively, Wireshark can be used to identify if the packet reached the destination device and if it is replying back.

Note:

Do not forget to disable the sniffer and debug flow once done troubleshooting:

• Disable debug flow using: diagnose debug reset.
• Disable the sniffer by pressing Ctrl+C on the keyboard or by closing the CLI window. 

Related article:

Troubleshooting Tip: How to perform initial troubleshooting when a device is unable to reach the internet