New Member

Question

IPSEC VPN Traffic ping not working

Forum|Forum|1 year ago
November 8, 2024
6 replies
4402 views

Hello,

we have a working tunnel (up) from one location to the other.

From the remote location, the ping arrives our firewall, but it does not reply to them (they get timeout).

Our ping seems to go through our firewall, but does not arrive the remote location (we also get timeout).

Both traffic is visible in the logs.

Policys from remote subnet to local subnet are there and vise versa. At least on our location, I'm waiting for response from the remote location.

Also we have a (in my opinion) working static route for the remote subnet, pointing to the vpn-connection.

Same interface / ip is also used for a second ipsec tunnel and this one is working fine (I get icmp: echo reply)

Any ideas or troubleshooting hints?

thanks

Toshi_Esumi

SuperUser

You have to, or ask whoever managing the remote end, sniff and run IKE debug on the remote device, since the local end seems to be fine based on your description.

Toshi

KumarV

Staff

Hello @Pkay983

You can run the commands mentioned below:

#di sniffer packet any "host x.x.x.x and icmp" 4 0 l

Initiate a ping from remote site to your Firewall and run the sniffer mentioned above.

x.x.x.x = src ip on remote site.

You should see tunnel In and Lan out. If you are not seeing the out packets then run the debugs below.

#di de flow filter addr x.x.x.x

#di de flow filter proto 1

#di de flow trace start 100

#di de en

Verender

DPadula

Staff & Editor

Adding to my colleague's comment, also add the command:

#di de flow show function enable

That command will give you more details regarding the traffic.

dingjerry_FTNT

Staff

Hi @Pkay983 ,

You need to run sniffer packet capture on FGT to see the ICMP echo request and echo reply packets to tell whether it is FGT blocking the traffic or not:

diag sniffer packet any 'host x.x.x.x and icmp' 4 // x.x.x.x can be the destination IP, or the source IP (but you need to make sure that there is no NAT in the firewall policy on your FGT)

Sign up

Login with SSO

Login to the community

Login with SSO