Skip to main content
sudipkamila
sudipkamila
New Member
December 11, 2025
Question

IPsec Tunnel Ping Issue Between Firewalls (Source Interface Required)

  • December 11, 2025
  • 2 replies
  • 366 views

I have two FortiGate firewalls located at different sites, connected through ISP links as WAN. An IPsec tunnel is established between both firewalls. LAN subnets on both sides can reach each other and ping successfully.

 

However, when I try to ping the remote LAN subnet from the firewall itself, the ping fails. The ping only works when I manually set the source interface on the firewall. I want to understand why the firewall cannot ping the remote LAN subnet without specifying the source interface.

 

  • Please assist in identifying the cause and provide the required configuration guidance.

2 replies

owen911
owen911
Visitor III
December 11, 2025

FortiGate uses a different interface as a source based on the lowest index number.
Based on local-out traffic, tentatively will be WAN interface.
it a normal behavior 
refer link : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Self-originating-traffic-over-IPSec-VPN-For/ta-p/193456

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
December 11, 2025

Most likely the source IP of the ping packets is outside of phase2 network selector(s). Use "exe ping-option source [the_LAN_interface_IP_inside_of_the_network_selector]". Then ping packets pick that IP for the source IP.

If you're curious what source IP it's picking up now, you can have two SSH sessions into your FGT. Then run like "diag sniffer packet [IPSEC_interface_name] 'icmp'" in one session, then run "exe ping" from another session. You can see the source IP in the sniffer.
Then you can see how it changes after the ping-option.
Toshi

Toshi

Terms & ConditionsAccessibility statement