One way Ping

When I do a debug of the flow, this is a sample of what I get over and over again when trying to ping from Location 1 to Location 2. And both locations have the exact same policies in place. Thanks so much id=13 trace_id=101 msg=" vd-root received a packet(proto=1, 10.8.138.180:1->10.8.22.254:8) from Internal." id=13 trace_id=101 msg=" allocate a new session-00001066" id=13 trace_id=101 msg=" find a route: gw-10.8.22.254 via Internal" id=13 trace_id=101 msg=" Denied by forward policy check" id=13 trace_id=102 msg=" vd-root received a packet(proto=1, 10.8.138.180:1->10.8.22.254:8) from Internal." id=13 trace_id=102 msg=" allocate a new session-0000106e" id=13 trace_id=102 msg=" find a route: gw-10.8.22.254 via Internal" id=13 trace_id=102 msg=" Denied by forward policy check" id=13 trace_id=103 msg=" vd-root received a packet(proto=1, 10.8.138.180:1->10.8.22.254:8) from Internal."

it says policy does not allow. Can you show your policy? show firewall policy

hi, and welcome to the forums. Are you pinging the remote FGT? If so, check the ' Restricted Hosts' setting in System>Admin. Set them all to ' 0.0.0.0/0' to see if ping is administratively prohibited. Next, is ping allowed on the interface (System>Network>Interface)? Next, did you try to reach a host on the remote network, like a printer? Printers don' t have personal firewalls...yet

Thank you so much for all the help, but I think I finally stumbled upon the problem. When I was looking in the Network -> interface area, I seen that my Internal interface wasn' t configured quite right. Once I fixed that, ping in both directions started working! Thanks again for all the help!

One more well meant hint: re-create your VPNs in ' Interface Mode' . You spare yourself a LOT of headaches over time. If you do, the tunnel end becomes a virtual network port, just like the physical ones. You use it in a regular (ACCEPT) policy, and in a static route, for NAT and all that. No more wondering what FortiOS does ' behind the scenes' as you do when using Policy Mode VPN.

Where do I do that? Create the VPNs in Interface mode?? Can I change the current setup to do that, or do I need to delete them and recreate them? Thanks Robert

When you create a Phase1, usually (from FortiOS 4.3 on) the ' Interface Mode' is checked by default. Alas, there is no (easy) way to change the mode. Just recreate Phase1 and Phase2.

So once I create those in interface mode, what do I need to create in static routes or any policies??? Thanks for taking this step by step for me, this is a whole new world for me! Thanks

Once you create an IPsec VPN in Interface Mode, there will be a new virtual interface under System>Network>Interfaces>the_wan_port_specified. What do you do to have traffic flow out on a port? let' s assume your tunnel is called ' Miami' and the remote network is 10.8.22.0/24: - create a static route to the remote subnet, using the tunnel interface e.g. 10.8.22.0/24 via ' Miami' (do not specify a gateway address!) - then allow traffic to pass from ' internal' to ' Miami' : create a firewall policy, source port ' internal' , src addr ' my_LAN' , dest port ' Miami' , dest addr 10.8.22.0/24, action ACCEPT (!), no NAT This will allow traffic initiated from your LAN to the ' Miami' network, including reply traffic. If you want to allow traffic initiated from Miami into your LAN, you need an additional policy with reversed source/destination. Assuming you have a mail server in Miami, and you query it for new messages. This will flow across just one policy. If you want the Miami people to get files from your LAN, you need a second policy. So, ' Interface Mode' VPN behave just like any other (physical or VLAN) port, in respect to routing and policies. This includes NAT, traffic shaping, UTM etc.

Thank you so much Ede! That makes sense now!! I will probably try to do this with our VPN. We have two phone systems in each location that need to use the VPN to make calls between buildings or transfer calls, however those calls are being dropped or never connected. It worked before we switched to these Fortinet boxes. We had Cisco routers before and an old cisco VPN configured, which i never touched or understood, and it worked good, but for some reason, its not working great with this new system. If the calls are connected, they are dropped within a few seconds...its really strange! Not sure what is going on there either.