Skip to main content
robert_espi
robert_espi
New Member
September 17, 2022
Question

IPSec VPN Clients Accessing Remote Subnets across Site to Site VPN

  • September 17, 2022
  • 1 reply
  • 3177 views

Hi Guys, 
Hoping someone can help.
I have Site to Site VPN established between two sites. Site A and Site B.
Site A IPSec VPN Subnet - 10.10.10.1.0/24 | Site B Local LAN Subnet 192.168.1.0/24
I want Site A IPsec VPN Clients to access resources hosted on Site B, which are connected thru STS VPN.
1.) I've already created static routes between Site A and Site B Subnets on both FG.

2.)I already have Policies established to allow Site A VPN Subnet access to Site B Local Subnet.

3.) I also have included both subnets in their respective Phase 2 selectors. 

I ran a ping test from Site A VPN to Site B subnet , and was only able to ping its gateway 192.168.1.1.

Not sure as to what more i must include in order to establish connection to the rest of 192.168.1.0/24.

 Feel free to chime in thoughts. Thanks in advance.

*Note that the two FG are connected using different IP addressed in the same Public IP Block xxx.xxx.x.x/29..not sure if that would cause any issues. 

1 reply

sagha
Staff
sagha
Staff
September 17, 2022

Hi robert_espi, 

 

You can run debug flows and check how FGT is dealing with traffic. 

 

diag de flow filter addr x.x.x.x

diag de flow filter proto 1

diag de flow trace start 100 

diag de en

 

Replace x.x.x.x with the destination address.

 

After that, ping the destination again. You can share the debugs here and we can have a look then. 

 

Thank you. 

Shahan Agha

robert_espi
robert_espiAuthor
New Member
September 18, 2022

FGT90D-IMM # exec ping 192.168.1.6
id=20085 trace_id=21 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.2.:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=0."
id=20085 trace_id=21 func=init_ip_session_common line=5619 msg="allocate a new session-073c1460"
id=20085 trace_id=21 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=21 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
id=20085 trace_id=22 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.22:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=1."
id=20085 trace_id=22 func=resolve_ip_tuple_fast line=5535 msg="Find an existing session, id-073c1460, original direction"
id=20085 trace_id=22 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=22 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
id=20085 trace_id=23 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.22:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=2."
id=20085 trace_id=23 func=resolve_ip_tuple_fast line=5535 msg="Find an existing session, id-073c1460, original direction"
id=20085 trace_id=23 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=23 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
id=20085 trace_id=24 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.22:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=3."
id=20085 trace_id=24 func=resolve_ip_tuple_fast line=5535 msg="Find an existing session, id-073c1460, original direction"
id=20085 trace_id=24 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=24 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
id=20085 trace_id=25 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, 222.22.222.22:19265->192.168.1.6:2048) from local. type=8, code=0, id=19265, seq=4."
id=20085 trace_id=25 func=resolve_ip_tuple_fast line=5535 msg="Find an existing session, id-073c1460, original direction"
id=20085 trace_id=25 func=ipsecdev_hard_start_xmit line=631 msg="enter IPsec interface-TO-Remote"
id=20085 trace_id=25 func=ipsec_common_output4 line=801 msg="No matching IPsec selector, drop"
binding source interface address error.
PING 192.168.1.6 (192.168.1.6): 56 data bytes

--- 192.168.1.6 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

A
Anonymous_User
Contributor III
September 19, 2022

Dear Customer.

From the output, I could see that "No matching IPsec selector, drop.
This means the Local/Remote subnet is not matching under Phase2 selectors.
Navigate to IPsec tunnels, edit the tunnels, and under Phase 2 selectors please verify if the Local and remote subnet matches.

From the logs, I could see that the source is 222.22.222.2, and the destination IP is 192.168.1.6.
Please verify and update the IP's accordingly, If you have NAT enabled in the policy then kindly disable it.

Terms & ConditionsAccessibility statement