New Member

Solved

Fortigate AWS VPN Site to Site with RUT951 is up, but communication not bidirectional on sites.

Forum|Forum|1 year ago
December 11, 2024
25 replies
5550 views

I have a site to site vpn mounted with my private subnet (10.0.1.0/24) and Teltonika router RUT951 subnet (192.168.10.0/24) which is connected to internet through dial up (SIM Card Telcel). The site to site is up and successfully running on phase1 and phase2 selectors..... But I canNOT ping or telnet from server in private net to the router RUT951 itself nor any device behind the router.

But I am able to do ping or telnet successfully from router RUT951 to server in private net.

From Fortigate CLI tried to do ping on 192.168.10.1, but no luck.

My guess is the issue should be on the firewall of the router RUT951, but I am new on this so I need help.

I have both policies allowing all access from RUT951 -> PRIVATE NET and PRIVATE NET -> RUT951 like below:

PRIVATE NET -> RUT951 Policy (This one does not work if doing ping or telnet disabling or enabling NAT, same result).

RUT951 -> PRIVATE NET (This one works perfect i can do ping or telnet)

Static Routes

IPSEC TUNNEL SITE TO SITE SUCCESS STATUS.

Screenshot 2024-12-10 at 5.44.48 p.m..png

More context:

Fortigate in a VM in AWS.

Private subnet as 10.0.1.0/24 where private server resides.

Public facing subnet 10.0.0.0/24.

My Teltonika RUT951 router subnet 192.168.10.0/24 (Internet access through SIM Card Telcel, not WAN as such).

RUT951 router ip address 192.168.10.1

Best answer by dingjerry_FTNT

Hi @OrtizJorge97 ,

Please specify the source IP for Ping on FGT:

execute ping-options source x.x.x.x // x.x.x.x is the IP assigned to port2

execute ping 192.168.10.1

Sudarsan

Explorer

Hi,

From the above information you have provided i could see NAT is enable in the security policy. Disable the NAT in the policy and clear the session. Then check.

OrtizJorge97Author

New Member

Could you give me more details on what you mean on "clear session", like clearing browser session ?

dingjerry_FTNT

Staff

Hi @OrtizJorge97 ,

You may run the following CLI commands to clear the sessions:

diag sys session filter proto 1

diag sys session clear

dingjerry_FTNTAnswer

Staff

Hi @OrtizJorge97 ,

Please specify the source IP for Ping on FGT:

execute ping-options source x.x.x.x // x.x.x.x is the IP assigned to port2

execute ping 192.168.10.1

OrtizJorge97Author

New Member

Looks like my router is responding and also devices behind it Screenshot 2024-12-10 at 6.40.39 p.m..png

it is weird that from my server in the private net (interface port2 10.0.1.10), it is not responding the ping

dingjerry_FTNT

Staff

Hi @OrtizJorge97 ,

Please run this CLI command and then reproduce the issue from your server in the private net:

diag sniffer packet any 'icmp and host 192.168.10.1' 4

ModEngine2

New Member

It looks like you're facing a one-way communication issue in your site-to-site VPN setup between the Fortigate and RUT951 routers. Since the VPN tunnel is established and you can ping and telnet from the RUT951 router to your private network but not vice versa, there are a few areas to check.

First, verify the firewall policies on both devices. Ensure that the policies allowing traffic from your private network to the RUT951 subnet are configured correctly on the Fortigate. Double-check that NAT (Network Address Translation) is disabled in both directions, as enabling it could sometimes block communication from one side.

On the RUT951 side, check its firewall rules and ensure that it allows inbound traffic from the private network (10.0.1.0/24). Sometimes, routers like the RUT951 may have more restrictive firewall settings for inbound connections, so it's important to make sure it isn't blocking traffic from your VPN network.

OrtizJorge97Author

New Member

Hi @ModEngine2 ,

Yes, inbound rules and firewalls allow all traffic, what is happening after so much debugging is that resources (private server) in private subnet when doing ping to 192.168.10.0/24 dont know where to point the traffic to.

in FGT CLI I inspected ping request for 192.168.10.1 to see if at least the request is coming.

so from my 10.0.1.27 server do ping on 192.168.10.1, does not reach the port2 (10.0.1.10) interface of Fortigate.

Already modified the routing tables for pointing 192.168.10.0/24 destination to the network interface of port2.

OrtizJorge97Author

New Member

@dingjerry_FTNT Got a winner!

Turns out the problem was in the interface of FGT port2 Source/dest check was enabled in aws, this one did not allow to do ping to other ips which are not inside the 10.0.1.0/24, I just disabled this check, and now I got communication from private net to RUT951 device(s)!

dingjerry_FTNT

Staff

Ah, glad to hear that you fixed the issue. I knew that there was nothing wrong with FGT :)

Sign up

Login with SSO

Login to the community

Login with SSO