Explorer II

Question

Cannot ping "some" devices over IPsec VPN

Forum|Forum|4 years ago
April 6, 2022
14 replies
17775 views

Hi all,

Not sure if this is a Fortigate issue but i've got a site connected to our main HQ with an IPSEC vpn between the two (60E V 7.0.3) and all is working fine however i've gone to ping some devices over there and found that i can ping some and not others. They are all on the same subnet and if i connected onto a machine within that subnet i can ping them all so i know that ping is enabled on the devices and i know that the gateway is set as they can get to the HQ side of the VPN fine.

I've ran a packet capture on the devices that i can't ping and the ping is showing as getting to the devices but nothing returns back ? There is only a single 48 port HP switch in between the devices and the router and all devices are in the same switch so i'm not sure why i can ping some and not the others ? Is there anything anyone can think of ?

Thanks

Ian

FortiGate

akristof

Staff

Hello,

Thank you for your question. If you verified, that the on the client that you are not able to reach with ping request is coming but reply is not generated, verify if the device has some build-in firewall (windows firewall, etc). Try to disable and ping it again.

ForgetItNetAuthor

Explorer II

There is no firewall on the client blocking it as i can ping those in question from a device on the same subnet and get a response so i know the ping is getting out of the device/s.

Thanks

akristof

Staff

Hi,

In that case, if you can see that the ICMP request is leaving the tunnel and is forwarded to destination, try enable SNAT on the firewall policy that is allowing traffic from Tunnel to LAN. But if fgt is gateway for the destination client, then it shouldn't matter if NAT is on or off.

sw2090

SuperUser

There is one difference that you must keep in mind:

if you ping from a machine within the same subnet that will be subnet-internal traffic it will route point-to-point and will not hit the FortiGate.

if you ping via the ipsec this is traffic from a different subnet/interface and will use the FGT as Gateway to be routed on. So FGT needs to know a route to that subnet plus a policy that allows the traffic. I guess you have that as you wrote that you can ping hosts in the destination network.

Probably you should check the default gateway of the hosts that you cannot ping from out of the ipsec. If they don't use FGT as default gw the reply to your ping cannot reach back to you...

Timur_Mohamed

Visitor III

This helped me.

ForgetItNetAuthor

Explorer II

I think I'll have to go to that site and do some testing from within that subnet. I'm "assuming" all the devices I can't get a ping back from do have a gateway as they can connect to the internet along with devices on the other end of the tunnel so in order to do that they must have the correct gateway. I've just realised though that it seems to be HP thin clients i can't get a reply back from and all other kit seems ok but i know the HP thin clients have a gateway as they are connecting fine to the servers at the other end on the IPsec VPN but i guess it's something to go on.......thanks all

Debbie_FTNT

Staff & Editor

You can also try pinging from the FortiGate directly - presumably one of its interfaces would be in the same subnet so should in theory be able to ping all of them?

ForgetItNetAuthor

Explorer II

Yes i can ping direct from the Fortigate and i've been onto one of the machines at the remote site and all looks ok, i can ping from there across the VPN and get a reply back. Trace Route returns ok, Gateway is ok, Firewall is ok

akristof

Staff

Hi,

In that case, if this way is working and when you are trying to ping from other way, from remote Client and you see ping on destination client but no reply is generated (in wireshark) then I still think that the best candidate is built-in firewall blocking it.

ianoakwell

New Member

Do you ever get this figured out? I started having the exact issue on one b2b tunnel. I have six other identical tunnels going to six clinics that all connect to our main office. All the configurations are basically identical and all are on the same software level. After applying the latest 7.2.3 patch one tunnel started exhibiting the exact behavior you described. It seems like I can ping things like printers or other headless devices, but I can't ping computers or servers on the same subnet. I can consistently get to one desktop, but no others. It is strangest thing I've ever seen.

fanyadastra

Visitor III

I have got the same problem.. I can't ping one server on remote subnet. It is not seen on nmap too, but other computers is okay. Also I can ping gateway of subnet. After I reset tunnel on both sites, server is available to ping. But after few minutes it stops working again.

ForgetItNetAuthor

Explorer II

Hi ianoakwell....i did but it was nothing to do with the routers, i managed to determine that it was only with "some" of the HP thin clients there and there was a problem with the firewall settings but there was also another device on there (a printer) that just wouldn't respond so it gave me a bit of a misleading source as i thought it was random devices but turned out it was just the thin clients and the printer was a seperate issue in itself. Not sure that will help you though, sorry