Issue viewing security camera over IPSec tunnel

The 3 basics of IPsec VPNs:

1) if the Phase2 network selector(s) is allowing the sourcr&destination combination to go/come through

2) Check routes for the destination, and the source for returning packets

3) if a set of policies is allowing the traffic for both directions

You need to check these on both sides of FGTs.

you are experiencing an issue with accessing a security camera over an IPsec tunnel between two FortiGate devices. Specifically, users from VLAN5 on Site B are unable to access the camera on Site A.

Here are some steps you can take to troubleshoot this issue:

1. Verify that the security policies on both FortiGate devices are configured correctly to allow traffic between the VLANs on Site B and the camera on Site A. Make sure that the source and destination addresses are set correctly and that the action is set to 'accept'.

2. Check that the IP addresses and subnet masks are set correctly on both FortiGate devices. Make sure that the IP addresses are within the correct ranges and that the subnet masks are set correctly.

3. Verify that the IPsec tunnel is set up correctly and that traffic is flowing between the two sites. You can use the 'diag vpn tunnel list' command to view the status of the IPsec tunnel.

4. Check that the routing tables on both FortiGate devices are configured correctly. Make sure that the routes to the camera on Site A are configured correctly and that the routes to VLAN5 on Site B are also configured correctly.

5. Consider configuring NAT policies on both FortiGate devices to allow traffic to flow between the IPsec tunnel and the local networks.

You might want to check the routing configuration on the devices at Site B, specifically for VLAN5. Ensure that the necessary routes are set up to allow traffic from VLAN5 to reach the cameras at Site A. It's also worth double-checking the firewall rules on both sides to ensure no restrictions are blocking the traffic. The process must be simpler if you use Vivint.com cameras. I hope that helps!

As per the setup please do the following >

On the site B check the routes for the camera subnets and make sure it is pointing to your ipsec tunnel.

Also check on the site B by running the command to check if the packets are being sent or not :

diagnose sniffer packet any "host <here put the ip of the camera> and icmp " 4 0 a

and check if the packets are going out or not.

On the site A check in the tunnel settings if the subnet 10.10.2.0/24 is present in the phase 2 selector or not and the reverse is present on the Site B or not.