IPSEC routing issue

hm that is rather few information.

Basically the routing gives the way. So first of all there must be a route that matches the destination.  Secondly there has to be a policy to allow the traffic.

If destination is a physical,vlan or switch interface you don't need explicite static routing since these automagically create a "connected" route with them. 

In these cases you just need some policy to allow the traffic to flow :)

All other cases require explicit static routing.

Alas the VPN itself will listen on the interface you selected when you created it.

This is only used for the VPN itself (transport + encryption). 

The rest as said is given by the routing and policies.

Could you explan you problems a bit more detailed then?

hm if it does that there must be some route matching the destination subnet that has the dmz interface as gateway. 

As said if that is physical interfaces, vlan interfaces or ipsec tunnels or switch interfaces (or trunks) there is no need for explicit static routing. The routing is already there once the interface is configured. 

Routing will be looked at in this order: 1. connected routes, 2. static routes and everything that don't match 1. or 2. will hit the default route.

On the other hand it could also be that the inteface shown to you is not correct. I remember that such things happened to me on a FGT too.

Also the tunnel could run client isolation which would mean that clients would not be able to access each other.

So have a look at your routing table on the FGT and see. 

Hi vincent

Please check below  document if this helps in your case
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Self-originating-traffic-over-IPSec-VPN-For/ta-p/193456

Thanks

I suspect you did not assigned any IP address to the tunnel interface of the firewall, if you do not assign any IP address to the tunnel interface it will take DMZ ip and leave the firewall. It will not go towards DMZ interface, it is just use that IP and try to enter IPSEC tunnel. If DMZ IP is not present in local phase2 selectors, firewall will block the traffic.

In order to avoid this scenario, either you need to define some IP address in tunnel interface and assign it to the local and remote selectors in phase 2 of the tunnel.

Or

You can set "execute ping-options source <lan interface ip>" (lan interface IP should be there in local phase2 selectors)

Then ping the remote network.