Skip to main content
siayred
siayred
New Member
January 11, 2024
Question

Access to VLANs via IPSEC VPN

  • January 11, 2024
  • 5 replies
  • 8982 views

Hi there,

 

I've been stuck on this for some weeks now, so hoping someone can help!

 

We have a third party vendor that needs access to our network and VLANs. The setup (which we inherited recently) has a Fortigate 80F in front of Alcatel switches. I have set up an IPSEC VPN on the Fortigate to the remote side, and this is up and passing traffic. The remote side is attempting to ping the gateway address of one of the VLANs and not getting a response (I've verified this with packet capture on the firewall).

 

I have tried adding the VLAN network into Phase 2 on the VPN on our side, and verified that this has also been done on the remote side, but the pings are still failing. One thing I think may be causing it is that none of the VLANs currently have an interface on the firewall; all the VLAN config is on the core switch and there are static routes for each VLAN on the firewall with the core switch as the gateway IP. Is there anything else I can try short of changing the setup to administer the VLANs from the Fortigate?

5 replies

Wuggles14
Wuggles14
Visitor III
January 11, 2024

Quite difficult to pick up anything obvious without looking at the config

But just to check that you have a route on the core switching for the subnets on the remote end of the VPN to go via the FGT

In the same vein, do you have NAT enabled on your firewall policies between the remote end and the VLANs on your local subnets?

siayred
siayredAuthor
New Member
January 11, 2024

Hi there,

 

Yes, routes are configured for the VLANs to go through the FGT, and NAT is enabled on the VPN.

hbac
Staff
hbac
Staff
January 11, 2024

Hi @siayred,

 

Please run the follow debug flow commands to see if the traffic is being dropped or not: 

 

di deb disable
di deb res
diagnose debug flow filter clear
di deb flow filter addr x.x.x.x
di deb flow filter proto 1
diagnose debug flow show function-name enable
di deb flow show iprope en
diagnose debug console timestamp enable
diagnose debug flow trace start 500
diagnose debug enable

 

Regards, 

siayred
siayredAuthor
New Member
January 11, 2024

Hi,

 

Thank you for this (fairly new to Fortigates!). I get the following response when running the debug:

2024-01-11 15:53:19 id=20085 trace_id=1 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=1, x.x.x.x:13->x.x.x.x:2048) from vpn-0d04503165b. type=8, code=0, id=13, seq=22082."
2024-01-11 15:53:19 id=20085 trace_id=1 func=init_ip_session_common line=5993 msg="allocate a new session-036ee050"
2024-01-11 15:53:19 id=20085 trace_id=1 func=iprope_dnat_check line=5121 msg="in-[vpn-0d04503165b], out-[]"
2024-01-11 15:53:19 id=20085 trace_id=1 func=iprope_dnat_tree_check line=823 msg="len=0"
2024-01-11 15:53:19 id=20085 trace_id=1 func=iprope_dnat_check line=5134 msg="result: skb_flags-02000008, vid-0, ret-no-match, act-accept, flag-00000000"
2024-01-11 15:53:19 id=20085 trace_id=1 func=ip_route_input_slow line=2264 msg="reverse path check fail, drop"
2024-01-11 15:53:19 id=20085 trace_id=1 func=ip_session_handle_no_dst line=6077 msg="trace"

 

I'm going to guess that the bolded part is the problem, but I can't find a clear answer on how to fix it?

hbac
Staff
hbac
Staff
January 11, 2024

@siayred,

 

"reverse path check fail, drop" means there is no static route to the source IP via "vpn-0d04503165b". You can create a static route and test again.

 

Regards, 

    mle2802
    Staff
    mle2802
    Staff
    January 11, 2024

    Hi @siayred,

    can you confirm if remote site route traffic to the tunnel rather than the default route?. Please also run the command to confirm if traffic is seen on FortiGate. 

    diag sniffer packet any "host X.X.X.X and icmp" 4 0 l 

    siayred
    siayredAuthor
    New Member
    January 11, 2024

    Hi there,

     

    Part of the difficulty with this is that we can't contact the admins on the remote side directly, we need to go through another company (long story), I've asked for more info but am not holding my breath!

    The command provided does show the traffic arriving on the Fortigate

    vbandha
    Staff
    vbandha
    Staff
    January 13, 2024

    Hi @siayred 

    Can you run this command to confirm if packet seen on fortigate is coming from same subnet :

    diag sniffer packet any "host <src IP> and host <dest IP>" 4 0 l

     

    The other side may be SNAT the traffic 

     

    sahmed_FTNT
    Staff & Editor
    sahmed_FTNT
    Staff & Editor
    January 14, 2024

    Things to check:
    - IPSEC phase 2 has 0.0.0.0 or all the vlans added which required to communicate over the tunnel
    - Static routes are configured on both sides
    - polices are configured with correct vlan interface to pass traffic over the tunnel

    Terms & ConditionsCookie settingsAccessibility statement