Bizarre IPSec routing issue

Forum|Forum|7 years ago
March 19, 2019
5 replies
4545 views

I have 2 Fortinet 30e firewalls connecting 2 sites via IPSec VPN. It's always worked great. One subnet is 192.168.0.0/24 and the other is 192.168.2.0/24.

As I said - no problems for months, now suddenly, from the 192.168.0.0/24 subnet I can ping some hosts on 192.168.2.0/24 but not others. If I ssh into a remote host that responds, I can ping hosts on the local network that don't respond over the VPN connection.

I'm at a bit of a loss. Has anyone ever experienced something like this?

m0j0

New Member

Probably need a bit more information to be able to help.

a) Can you run a packet capture on the inside interface of you 192.168.2.0/24 firewall to see if the packets are exiting that firewall.

b) If they are, does a packet capture on this same interface see returning packets.

c) If yes to 'a' and no to 'b' can you run a tcpdump/wireshark capture on the target machine to see what it's doing with this traffic.

d) Do the working and non-working targets have the same gateway set?

e) Check the subnet mask on the non-working targets. Are they definitely set to /24? If they've been set to something like /22 or /16 then that would explain the behaviour you're seeing. Are these machines getting their IP from DHCP? If so, maybe someone has introduced a rogue DHCP server onto the network that has the incorrect subnet mask.

There could be many other reasons, but this is a start.

ede_pfau

SuperUser

I'd suspect either you have 2 WAN lines, or the subnet mask settings (somewhere) are incorrect.

rbrossAuthor

Visitor III

Ok, not time this morning for packet capture, but:

1) To start with for context, all machines are Linux

2) There is only a single WAN at each endpoint

3) Pinging the other end using the CLI on the Fortinets provides the same results as from the machines themselves.

4) The Linux machines (Debian or Ubuntu server) all use static IPs and the /etc/network/interfaces configs are identical (except for the "address" of course) - see below.

5) The gateways are set to the Fortinets - 192.168.0.1 at one end and 192.168.2.1 at the other.

auto eth0 iface eth0 inet static address 192.168.2.29 netmask 255.255.255.0 gateway 192.168.2.1

Sign up

Login with SSO

Login to the community

Login with SSO