Skip to main content
graham_morrison
graham_morrison
New Member
August 25, 2020
Question

IPSec to IPSec Tunnel Traffic

  • August 25, 2020
  • 4 replies
  • 6641 views

Hi there everyone,

 

With everyone going remote working we have come across an issue.  We have our tech support tunnel that us IT support folk are using.  We have another ipsec tunnel that our users are coming in over.  We cannot get traffic to flow between these tunnels.  So far in setting this up I have:

 

Added the subnets to both tunnels and checked they appear on the client routing tables

Created policy rules with sources and destinations as being the tunnel interfaces

Had sniffers running at the command line and see the traffic going one way over the tunnel and hitting a client pc but nothing coming back.

 

Running wireshark on clients on either side if the tunnel i can see the ping packets hitting them but them not sending anything back.

Am i missing something super obvious? 

4 replies

sw2090
SuperUser
sw2090
SuperUser
August 26, 2020

recheck client routing table. Do you have overlapping subnets there?

recheck client firewall if that is blocking you?

graham_morrison
graham_morrisonAuthor
New Member
August 26, 2020

Thanks for reply.  The tracert from the ipsec clients shows the forst hop as the external ip of the FW so that would suggest to me the route is ok since its trying to route it over the tunnel.  All the clients have their local FW's off as well.

Yurisk
SuperUser
Yurisk
SuperUser
August 26, 2020

Strange to hear that from PC ping enters the tunnel, but on the FGT sniffer you see nothing, it is highly unikely for ping to enter the tunnel directed to the FGT and never make to the FGT itself. I'd even say it is impossible. 

Have you run "diag deb flow" on those PC's pings ? Make sure no NAT is involved not to miss packets in sniffer.

 

yurisk.info - all things Fortinet blog, no ads
fortihaza
fortihaza
New Member
April 5, 2021

hey man did you manage to achive that cause i am in quite similar problem, i want to route my ipsec remote access vpn to site to site vpn. 

fortihaza
fortihaza
New Member
April 5, 2021

hey man did you manage to achive that cause i am in quite similar problem, i want to route my ipsec remote access vpn to site to site vpn 

ekrishnan
Staff
ekrishnan
Staff
November 9, 2023

Hi,

 

Are you referring to Remote access VPN meaning you are connected to FCT for first layer of vpn connection and from there you want it to go through another Site-Site IPSEC tunnel?

 

If that is the case you will need to add matching selectors on the  existing site-site ipsec tunnel i.e the selectors should include the remote access vpn ip address range in it and also the firewall policies to include this as well.

Terms & ConditionsAccessibility statement