Skip to main content
JLopezM22
JLopezM22
New Member
July 6, 2022
Question

Fortigate no Matching IPsec Selector error

  • July 6, 2022
  • 8 replies
  • 6063 views

i'm trying to fix the following comunication between:

Config VLAN-OBIS-DMZ:

 

 

Spoiler

SS-01 (root) # show system interface VLAN-OBIS-DMZ
config system interface
edit "VLAN-OBIS-DMZ"
set vdom "root"
set ip 192.168.77.1 255.255.255.0
set allowaccess ping https http
set device-identification enable
set role dmz
set snmp-index 91
set interface "STACKSCALE"
set vlanid 3017
next
end

 

 

Config router info:

Spoiler
SS-01 (root) # get router info routing-table details 192.168.77.2

Routing table for VRF=0
Routing entry for 192.168.77.0/24
Known via "connected", distance 0, metric 0, best
* is directly connected, VLAN-OBIS-DMZ

Routing entry for 192.168.77.0/24
Known via "static", distance 10, metric 0
directly connected, IPSEC-OBISPADO

SS-01 (root) # get router info routing-table details 192.168.0.102

Routing table for VRF=0
Routing entry for 192.168.0.0/22
Known via "static", distance 10, metric 0, best
* directly connected, IPSEC-OBISPADO

Situation:

2 networks

192.168.77.0/24 DMZ with netscalers
192.168.0.0/22

We want comunicate bidirectionaly

> 192.168.77.0/24 <--> 192.168.0.0/22

For the comunication we have a fortigate with an IPsec Tunnel up.

I'm trying to ping from:

> 1. 192.168.77.2 --> 192.168.0.102
> 2. 192.168.0.102 --> 192.168.77.2

 

In the debug we have:

 

 

Spoiler

id=20085 trace_id=312 func=print_pkt_detail line=5460 msg="vd-root:0 received a packet(proto=1, 192.168.77.2:27575->192.168.0.102:2048) from VLAN-OBIS-DMZ. type=8, code=0, id=27575, seq=72."
id=20085 trace_id=312 func=resolve_ip_tuple_fast line=5540 msg="Find an existing session, id-00398da0, original direction"
id=20085 trace_id=312 func=npu_handle_session44 line=1143 msg="Trying to offloading session from VLAN-OBIS-DMZ to IPSEC-OBISPADO, skb.npu_flag=00000400 ses.state=00010200 ses.npu_state=0x01000000"
id=20085 trace_id=312 func=fw_forward_dirty_handler line=449 msg="state=00010200, state2=00000000, npu_state=01000000"
id=20085 trace_id=312 func=__ip_session_run_tuple line=3241 msg="SNAT 192.168.77.2->10.10.10.1:27575"
id=20085 trace_id=312 func=ipsecdev_hard_start_xmit line=777 msg="enter IPsec interface-IPSEC-OBISPADO"
id=20085 trace_id=312 func=ipsec_common_output4 line=876 msg="No matching IPsec selector, drop"
id=20085 trace_id=313 func=print_pkt_detail line=5460 msg="vd-root:0 received a packet(proto=1, 192.168.77.2:27575->192.168.0.102:2048) from VLAN-OBIS-DMZ. type=8, code=0, id=27575, seq=73."
id=20085 trace_id=313 func=resolve_ip_tuple_fast line=5540 msg="Find an existing session, id-00398da0, original direction"
id=20085 trace_id=313 func=npu_handle_session44 line=1143 msg="Trying to offloading session from VLAN-OBIS-DMZ to IPSEC-OBISPADO, skb.npu_flag=00000400 ses.state=00010200 ses.npu_state=0x01000000"
id=20085 trace_id=313 func=fw_forward_dirty_handler line=449 msg="state=00010200, state2=00000000, npu_state=01000000"
id=20085 trace_id=313 func=__ip_session_run_tuple line=3241 msg="SNAT 192.168.77.2->10.10.10.1:27575"
id=20085 trace_id=313 func=ipsecdev_hard_start_xmit line=777 msg="enter IPsec interface-IPSEC-OBISPADO"
id=20085 trace_id=313 func=ipsec_common_output4 line=876 msg="No matching IPsec selector, drop"
id=20085 trace_id=314 func=print_pkt_detail line=5460 msg="vd-root:0 received a packet(proto=1, 192.168.77.2:27575->192.168.0.102:2048) from VLAN-OBIS-DMZ. type=8, code=0, id=27575, seq=74."
id=20085 trace_id=314 func=resolve_ip_tuple_fast line=5540 msg="Find an existing session, id-00398da0, original direction"
id=20085 trace_id=314 func=npu_handle_session44 line=1143 msg="Trying to offloading session from VLAN-OBIS-DMZ to IPSEC-OBISPADO, skb.npu_flag=00000400 ses.state=00010200 ses.npu_state=0x01000000"
id=20085 trace_id=314 func=fw_forward_dirty_handler line=449 msg="state=00010200, state2=00000000, npu_state=01000000"
id=20085 trace_id=314 func=__ip_session_run_tuple line=3241 msg="SNAT 192.168.77.2->10.10.10.1:27575"
id=20085 trace_id=314 func=ipsecdev_hard_start_xmit line=777 msg="enter IPsec interface-IPSEC-OBISPADO"
id=20085 trace_id=314 func=ipsec_common_output4 line=876 msg="No matching IPsec selector, drop"

Anyone have an idea why?

 

8 replies

aionescu
Staff
aionescu
Staff
July 6, 2022

Hi @JLopezM22

 

From the debug we can see that there is SNAT involved "SNAT 192.168.77.2->10.10.10.1:27575" so traffic will be sourced with IP address 10.10.10.1. 

Is this IP or subnet configured in under the phase2 selectors?

    JLopezM22
    JLopezM22Author
    New Member
    July 6, 2022

    Thanks for your reply

     

    Yes i have configured the following in the phase2:

     

    local address: 10.58.152.0/24

    remote address: 192.168.0.0/24

     

    the snat is 10.10.10.1 is the physical dmz interface and is disabled. 

      aionescu
      Staff
      aionescu
      Staff
      July 6, 2022

      Can you please clarify the statement "the snat is 10.10.10.1 is the physical dmz interface and is disabled"?

      As we see in the debug flow the source of the traffic is 10.10.10.1 and, based on the configuration that subnet is not present in the phase2 configuration. Can you add it and see if it works? Also @Toshi_Esumi's observation is correct. Why is there a static route for the same prefix over the tunnel?

      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      July 6, 2022

      I saw your earlier post below and felt something is quite off for your network setting.

      https://community.fortinet.com/t5/Fortinet-Forum/error-reverse-path-check-fail-drop/td-p/216782

      And now you changed a subnet or adding a new subnet to be reachable over the IPsec?

       

      Whatever.... so on this SS-01 FGT you have 192.168.77.0/24(VLAN 3017) on "STACKSCALE" interface locally. Then why do you have a static route for the same subnet toward the IPSec tunnel " IPSEC-OBISPADO"? The static route you need to have toward the tunnel is for the remote subnet, in your description above it's 192.168.0.0/22.

       

      Toshi

        JLopezM22
        JLopezM22Author
        New Member
        July 6, 2022

        Thanks for your reply toshi, 

         

        The 192.168.77.0 was a test static route that i must delete. 

         

        I already have the rule

         

        Spoiler
        SS-01 # config vdom

        SS-01 (vdom) # edit root
        current vf=root:0

        SS-01 (root) # config router static

        SS-01 (static) # edit "19"

        SS-01 (19) # show
        config router static
        edit 19
        set dst 192.168.0.0 255.255.252.0
        set device "IPSEC-OBISPADO"
        next
        end
        Toshi_Esumi
        SuperUser
        Toshi_Esumi
        SuperUser
        July 6, 2022

        So you're now closing this post and going back to the original one with 10.58.156.0/24 on this SS-01 FGT? 

         

        Toshi

        Terms & ConditionsAccessibility statement
        Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
        Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!