Cannot ping interface IP from AWS VPN

Hi,

Can you take the pcap on the FGT

diag sniff packet any 'host x.x.x.x and icmp' 4 0 l >> where x.x.x.x is the dst IP

Hi

Can you show the log from the first packet (the one you shared is starting from the 3rd).

Also have you created a policy to allow ping from SSL-VPN tunnel to lan interface?

Hi @chocolateeater ,

1) Please make sure that there is one firewall policy allowing Ping traffic from vpn-0d40f99b interface to lan interface.

2) Please make sure that there is no trusted host configured with your admin accounts.

Also, please collect the outputs with the following commands:

diag sys session filter proto 1

diag sys session filter dst 192.168.4.1

diag sys session list

It's better also attach your FGT config.

Hi, all.

Funny thing. When I ran pcap suggested by @sjoshi, after 8-10 seconds suddenly it worked. I did nothing. Then I left to handle some other stuff, and when I came back it didn't work, again. That got me thinking about NP offloading or asymmetric routing issues, but I haven't been able to confirm this. 

The interface IP is now 192.168.40.1 (tried quite a few things), and there is a new host in AWS (172.31.40.192). Sorry I can't drop the complete config here, for security reasons.

Here is a new capture, based on the suggestions:

FG-101F # diag sniff packet any 'host 192.168.40.1 and icmp' 4 0 1 interfaces=[any] filters=[host 192.168.40.1 and icmp] 2.975748 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request 7.975738 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request 12.975803 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request 17.976778 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request 22.976357 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request ^C 5 packets received by filter 0 packets dropped by kernel  FG-101F # diag sys session filter proto 1  FG-101F # diag sys session filter dst 192.168.40.1  FG-101F # diag sys session list  session info: proto=1 proto_state=00 duration=37698 expire=58 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3 origin-shaper= reply-shaper= per_ip_shaper= class_id=0 ha_id=0 policy_dir=0 tunnel=/ tun_id=0.0.0.0/18.193.132.248 vlan_cos=0/0 state=local may_dirty npu  statistic(bytes/packets/allow_err): org=497040/8284/1 reply=56820/947/1 tuples=2 tx speed(Bps/kbps): 13/0 rx speed(Bps/kbps): 1/0 orgin->sink: org pre->in, reply out->post dev=77->36/36->78 gwy=192.168.40.1/0.0.0.0 hook=pre dir=org act=noop 172.31.40.192:1->192.168.40.1:8(0.0.0.0:0) hook=post dir=reply act=noop 192.168.40.1:1->172.31.40.192:0(0.0.0.0:0) misc=0 policy_id=53 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=0 serial=000057c8 tos=ff/ff app_list=0 app=0 url_cat=0 rpdb_link_id=00000000 ngfwid=n/a npu_state=0x000001 no_offload npu info: flag=0x00/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0x0000/0x0000 vlifid=0/0, vtag_in=0x0000/0x0000 in_npu=0/0, out_npu=0/0, fwd_en=0/0, qid=0/0 no_ofld_reason:  local disabled-by-policy total session 1  FG-101F # diag sniff packet any 'host 172.31.40.192 and icmp' 4 0 1 interfaces=[any] filters=[host 172.31.40.192 and icmp] 3.714953 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request 8.711020 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request 10.301561 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.13: icmp: echo request 10.301644 lan out 172.31.40.192 -> 192.168.40.13: icmp: echo request 10.301648 fortilink out 172.31.40.192 -> 192.168.40.13: icmp: echo request 10.301653 x2 out 172.31.40.192 -> 192.168.40.13: icmp: echo request 10.301761 lan in 192.168.40.13 -> 172.31.40.192: icmp: echo reply 10.301790 vpn-0d40f99b-2 out 192.168.40.13 -> 172.31.40.192: icmp: echo reply 13.710008 vpn-0d40f99b in 172.31.40.192 -> 192.168.40.1: icmp: echo request ^C 9 packets received by filter 0 packets dropped by kernel  FG-101F # show firewall policy 53 config firewall policy     edit 53         set name "aws to office lan"         set uuid 813dbc08-842a-51ef-e803-b022fa3ef30e         set srcintf "vpn-0d40f99b"         set dstintf "lan"         set action accept         set srcaddr "AWS"         set dstaddr "lan address"         set schedule "always"         set service "ALL"         set logtraffic all         set capture-packet enable         set auto-asic-offload disable     next end  FG-101F # show firewall policy 59 config firewall policy     edit 59         set name "aws 2 to lan"         set uuid 872e1386-842c-51ef-2e34-67700f53b3ed         set srcintf "vpn-0d40f99b-2"         set dstintf "lan"         set action accept         set srcaddr "AWS"         set dstaddr "lan address"         set schedule "always"         set service "ALL"         set logtraffic all         set capture-packet enable         set auto-asic-offload disable     next end 

I have discovered something strange (maybe), though. There is a mismatch in the static routes in the GUI and CLI (have removed routes not relevant, here):

FG-101F # get router info routing-table static Routing table for VRF=0 S*      0.0.0.0/0 [10/0] via 195.159.198.177, wan1, [1/0] S       169.254.87.188/30 [5/0] via vpn-0d40f99b-2 tunnel 52.58.248.162, [1/0] S       169.254.91.32/30 [5/0] via vpn-0d40f99b tunnel 18.193.132.248, [1/0] S       172.31.0.0/16 [20/0] via vpn-0d40f99b-2 tunnel 52.58.248.162, [1/0]

Hi, @sjoshi.

I have changed interface IP to 192.168.40.1. So that is the correct IP.

Here is the full output:

FG-101F # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP        O - OSPF, IA - OSPF inter area        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2        E1 - OSPF external type 1, E2 - OSPF external type 2        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area        V - BGP VPNv4        * - candidate default  Routing table for VRF=0 S*      0.0.0.0/0 [10/0] via 195.159.198.177, wan1, [1/0] C       10.10.1.0/24 is directly connected, guest_wlan S       10.10.1.2/32 [15/0] via VPN tunnel 10.10.1.2, [1/0] S       10.10.1.3/32 [15/0] via VPN tunnel 10.10.1.3, [1/0] S       10.10.10.0/24 [10/0] via Intro SD tunnel 193.71.92.26, [1/0] C       10.253.240.0/20 is directly connected, wqt.root C       10.255.11.0/24 is directly connected, quarantine C       10.255.12.0/24 is directly connected, rspan C       10.255.13.0/24 is directly connected, nac_segment C       169.254.1.0/24 is directly connected, fortilink C       169.254.2.1/32 is directly connected, VPN C       169.254.2.15/32 is directly connected, SW to FG S       169.254.87.188/30 [5/0] via vpn-0d40f99b-2 tunnel 52.58.248.162, [1/0] C       169.254.87.190/32 is directly connected, vpn-0d40f99b-2 S       169.254.91.32/30 [5/0] via vpn-0d40f99b tunnel 18.193.132.248, [1/0] C       169.254.91.34/32 is directly connected, vpn-0d40f99b C       172.18.0.0/21 is directly connected, intro_guest_w S       172.31.0.0/16 [20/0] via vpn-0d40f99b-2 tunnel 52.58.248.162, [1/0] C       192.168.19.0/24 is directly connected, port12 C       192.168.22.0/24 is directly connected, port7 C       192.168.24.0/24 is directly connected, port6 C       192.168.25.0/24 is directly connected, teknisk lan C       192.168.28.0/24 is directly connected, port9 C       192.168.31.0/24 is directly connected, port2 C       192.168.40.0/24 is directly connected, lan C       192.168.41.0/24 is directly connected, wlan ap C       192.168.50.0/24 is directly connected, wifi lan C       192.168.55.0/24 is directly connected, guest_b C       192.168.60.0/28 is directly connected, intro_info C       192.168.62.0/29 is directly connected, intro_klang C       192.168.63.0/29 is directly connected, intro_present C       192.168.98.0/24 is directly connected, intro_ph_access  FG-101F # get router info routing-table database Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP        O - OSPF, IA - OSPF inter area        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2        E1 - OSPF external type 1, E2 - OSPF external type 2        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area        V - BGP VPNv4        > - selected route, * - FIB route, p - stale info  Routing table for VRF=0 S    *> 0.0.0.0/0 [10/0] via 195.159.198.177, wan1, [1/0] C    *> 10.10.1.0/24 is directly connected, guest_wlan S       10.10.1.0/24 [10/0] is directly connected, VPN, [1/0] S    *> 10.10.1.2/32 [15/0] via VPN tunnel 10.10.1.2, [1/0] S    *> 10.10.1.3/32 [15/0] via VPN tunnel 10.10.1.3, [1/0] S    *> 10.10.10.0/24 [10/0] via Intro SD tunnel 193.71.92.26, [1/0] C    *> 10.253.240.0/20 is directly connected, wqt.root C    *> 10.255.11.0/24 is directly connected, quarantine C    *> 10.255.12.0/24 is directly connected, rspan C    *> 10.255.13.0/24 is directly connected, nac_segment C    *> 169.254.1.0/24 is directly connected, fortilink C    *> 169.254.2.1/32 is directly connected, VPN C    *> 169.254.2.15/32 is directly connected, SW to FG S    *> 169.254.87.188/30 [5/0] via vpn-0d40f99b-2 tunnel 52.58.248.162, [1/0] C    *> 169.254.87.190/32 is directly connected, vpn-0d40f99b-2 S    *> 169.254.91.32/30 [5/0] via vpn-0d40f99b tunnel 18.193.132.248, [1/0] C    *> 169.254.91.34/32 is directly connected, vpn-0d40f99b C    *> 172.18.0.0/21 is directly connected, intro_guest_w S       172.31.0.0/16 [10/0] via vpn-0d40f99b tunnel 18.193.132.248 inactive, [1/0] S    *> 172.31.0.0/16 [20/0] via vpn-0d40f99b-2 tunnel 52.58.248.162, [1/0] C    *> 192.168.19.0/24 is directly connected, port12 C    *> 192.168.22.0/24 is directly connected, port7 C    *> 192.168.24.0/24 is directly connected, port6 C    *> 192.168.25.0/24 is directly connected, teknisk lan C    *> 192.168.28.0/24 is directly connected, port9 C    *> 192.168.31.0/24 is directly connected, port2 S       192.168.40.0/24 [10/0] is directly connected, l2t.root, [1/0] C    *> 192.168.40.0/24 is directly connected, lan C    *> 192.168.41.0/24 is directly connected, wlan ap C    *> 192.168.50.0/24 is directly connected, wifi lan C    *> 192.168.55.0/24 is directly connected, guest_b C    *> 192.168.60.0/28 is directly connected, intro_info

Why is this one inactive...? In the GUI it is not. Normal?

172.31.0.0/16 [10/0] via vpn-0d40f99b tunnel 18.193.132.248 inactive, [1/0]

Hi, @sjoshi .

Not using SD WAN. Not sure if I can direct traffic to a particular tunnel in AWS, but will look into it. Link monitor is in use, which is why it doesn't work to bring tunnel 2 down, it just goes back up. 

Here is the output:

FG-101F (link-monitor) # show config system link-monitor     edit "awsmon"         set srcintf "vpn-0d40f99b"         set server "169.254.87.189"         set interval 2000         set recoverytime 2     next end  FG-101F # diagnose vpn ike gateway list  (...) vd: root/0 name: vpn-0d40f99b version: 1 interface: wan1 7 addr: 195.159.198.179:4500 -> 18.193.132.248:4500 tun_id: 18.193.132.248/::18.193.132.248 remote_location: 0.0.0.0 network-id: 0 virtual-interface-addr: 169.254.91.34 -> 169.254.91.33 created: 673s ago peer-id: 18.193.132.248 peer-id-auth: no nat: peer IKE SA: created 1/1  established 1/1  time 70/70/70 ms IPsec SA: created 1/1  established 1/1  time 110/110/110 ms    id/spi: 60 6aae36d77afa1460/36d8f791bc7116d6   direction: initiator   status: established 673-673s ago = 70ms   proposal: aes128-sha1   key: 7fe3cff0abdbaaa7-08161b3d67bfa247   lifetime/rekey: 28800/27826   DPD sent/recv: 00000000/4522f231   peer-id: 18.193.132.248