Cannot exec ping from WAN interface

12 replies
36768 views

Hi,

I've got a strange problem with my Fortigate 800.

When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>

FGT800-XX-XX $ execute ping 8.8.4.4

The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.

Here the result :

msg="enter IPsec tunnel-FGT-XXXX-XXXX" 2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop"

ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly.

I need this to configure Dead Gateway Detection option.

Thanks for help

ede_pfauAnswer

SuperUser

A premium example of the hidden pitfalls of policy based VPN. The address objects in the policy are used both for the QM selectors and the routing. Too bad you can't see that.

Go with the golden advice and recreate the VPN in interface / route-based mode.

rwpatterson

New Member

Welcome to the forums.

Try setting the PING options. Not sure of the exact syntax, but from a prompt type:

ping-options ?

will get you a list of those options. One is source IP address which is why I think your PING request is failing.

SODAuthor

New Member

I've already set some options to see if the problem come from ping-options.

execute ping-options source <ip-of-my-wan-interface>

execute ping-options timeout 5

execute ping-options Validate Reply yes

options available :

FGT800-xx-01 $ execute ping-options view-settings Ping Options: Repeat Count: 5 Data Size: 56 Timeout: 2 Interval: 1 TTL: 64 TOS: 0 DF bit: unset Source Address: auto Pattern: Pattern Size in Bytes: 0 Validate Reply: no

Regards