IPsec Tunnel Ping Issue Between Firewalls (Source Interface Required)

Forum|Forum|9 months ago
December 11, 2025
2 replies
359 views

I have two FortiGate firewalls located at different sites, connected through ISP links as WAN. An IPsec tunnel is established between both firewalls. LAN subnets on both sides can reach each other and ping successfully.

However, when I try to ping the remote LAN subnet from the firewall itself, the ping fails. The ping only works when I manually set the source interface on the firewall. I want to understand why the firewall cannot ping the remote LAN subnet without specifying the source interface.

Please assist in identifying the cause and provide the required configuration guidance.

IPsec

owen911

Visitor III

FortiGate uses a different interface as a source based on the lowest index number.
Based on local-out traffic, tentatively will be WAN interface.
it a normal behavior
refer link : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Self-originating-traffic-over-IPSec-VPN-For/ta-p/193456

Toshi_Esumi

SuperUser

Most likely the source IP of the ping packets is outside of phase2 network selector(s). Use "exe ping-option source [the_LAN_interface_IP_inside_of_the_network_selector]". Then ping packets pick that IP for the source IP.

If you're curious what source IP it's picking up now, you can have two SSH sessions into your FGT. Then run like "diag sniffer packet [IPSEC_interface_name] 'icmp'" in one session, then run "exe ping" from another session. You can see the source IP in the sniffer.
Then you can see how it changes after the ping-option.
Toshi

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO