IPsec VPN - Can't access internal network

Hello @BKR ,

- Can you run the following debugs while pinging the destination:

In Console1:
get router info routing-table details <source-ip>
get router info routing-table details <destination-ip>
di de reset
diagnose debug flow filter addr xx.xx.xx.xx yy.yy.yy.yy and <--- xx is source-IP and yy is destination-ip
di de flow filter proto 1
diagnose debug flow show function enable
diagnose debug flow show iprope enable
diagnose debug console timestamp enable
diagnose debug flow trace start 999
diagnose debug enable

In Console 2:
diag sniffer packet any "(host xx.xx.xx.xx and host yy.yy.yy.yy) and icmp" 4 0 l <---xx is SourceIP and yy is DestinationIP

- also if you can show policy config which is being used.

Hello @BKR 

Can you please make sure VLAN subnet is added in accessible network and policy has been created from IPSec tunnel to vlan and vice versa.

If the vlans are configured and attached to port2 you need to create firewall policies from the VPN interface to each vlan to be able to access resources on those vlans. Remember to add those vlans on accessible networks under VPN phase-1.

If those vlans are routed via port2, which mean they're configured on the next-hop switch, NOT on fortigate, and if you've static routes already configured for reachability from port2, you can enable NAT on the relevant firewall policy and test if it works.

If it still not work after the above, this means the destination server/client on those vlans are the source of the problem. This could be some security software blocking such traffic.

Hope this helps