Ping works from host A to B but no https
I recently replaced network switches in location A. After that, I'm having a weird issue. vCenter in location B can't connect to hosts in location A. I can ping the hosts from B to A. I used to https directly to those hosts and it worked. Now, I get a timeout. I ran packet capture from a Fortigate FW that's in front of hosts in A. The following is what I got.
17.707177 192.168.150.75.49443 -> 10.0.31.161.443: syn 1184427505
17.707199 192.168.150.75.49443 -> 10.0.31.161.443: syn 1184427505
17.707201 192.168.150.75.49443 -> 10.0.31.161.443: syn 1184427505
17.707202 192.168.150.75.49443 -> 10.0.31.161.443: syn 1184427505
17.707500 10.0.31.161.443 -> 192.168.150.75.49443: syn 3833218006 ack 1184427506
17.707509 10.0.31.161.443 -> 192.168.150.75.49443: syn 3833218006 ack 1184427506
17.707510 10.0.31.161.443 -> 192.168.150.75.49443: syn 3833218006 ack 1184427506
17.707511 10.0.31.161.443 -> 192.168.150.75.49443: syn 3833218006 ack 1184427506
17.712783 192.168.150.75.49443 -> 10.0.31.161.443: ack 3833218007
17.712788 192.168.150.75.49443 -> 10.0.31.161.443: ack 3833218007
17.712788 192.168.150.75.49443 -> 10.0.31.161.443: ack 3833218007
17.712789 192.168.150.75.49443 -> 10.0.31.161.443: ack 3833218007
17.713157 192.168.150.75.49443 -> 10.0.31.161.443: psh 1184427506 ack 3833218007
17.713160 192.168.150.75.49443 -> 10.0.31.161.443: psh 1184427506 ack 3833218007
17.713161 192.168.150.75.49443 -> 10.0.31.161.443: psh 1184427506 ack 3833218007
17.713162 192.168.150.75.49443 -> 10.0.31.161.443: psh 1184427506 ack 3833218007
17.714042 10.0.31.161.27656 -> 172.21.1.14.514: udp 196
17.720952 10.0.31.161.443 -> 192.168.150.75.49443: 3833218007 ack 1184428023
17.720958 10.0.31.161.443 -> 192.168.150.75.49443: 3833218007 ack 1184428023
17.720959 10.0.31.161.443 -> 192.168.150.75.49443: 3833218007 ack 1184428023
17.720960 10.0.31.161.443 -> 192.168.150.75.49443: 3833218007 ack 1184428023
17.720962 10.0.31.161.443 -> 192.168.150.75.49443: psh 3833219467 ack 1184428023
17.720965 10.0.31.161.443 -> 192.168.150.75.49443: psh 3833219467 ack 1184428023
17.720965 10.0.31.161.443 -> 192.168.150.75.49443: psh 3833219467 ack 1184428023
17.720966 10.0.31.161.443 -> 192.168.150.75.49443: psh 3833219467 ack 1184428023
17.726126 192.168.150.75.49443 -> 10.0.31.161.443: ack 3833218007
17.726129 192.168.150.75.49443 -> 10.0.31.161.443: ack 3833218007
17.726130 192.168.150.75.49443 -> 10.0.31.161.443: ack 3833218007
17.726130 192.168.150.75.49443 -> 10.0.31.161.443: ack 3833218007
17.737490 192.168.150.75.49447 -> 10.0.31.161.443: syn 1227299052
17.737502 192.168.150.75.49447 -> 10.0.31.161.443: syn 1227299052
17.737503 192.168.150.75.49447 -> 10.0.31.161.443: syn 1227299052
17.737503 192.168.150.75.49447 -> 10.0.31.161.443: syn 1227299052
17.737770 10.0.31.161.443 -> 192.168.150.75.49447: syn 3908853215 ack 1227299053
17.737775 10.0.31.161.443 -> 192.168.150.75.49447: syn 3908853215 ack 1227299053
17.737776 10.0.31.161.443 -> 192.168.150.75.49447: syn 3908853215 ack 1227299053
17.737776 10.0.31.161.443 -> 192.168.150.75.49447: syn 3908853215 ack 1227299053
And also, I see "server-rst" messages on the Fortigate FW in location A. One thing I notice, "https" to those hosts works only within the same location. That's the weird thing. All FW rules are there to allow. It looks like it doesn't work when the "https" traffic passes the FW. Can a certificate be an issue? I'm not sure if I make any sense.
I spent hours troubleshooting on this. I can't think of anything anymore. I'll really appreciate any suggestions. Let me know if you need anything else. Thank you in advance.
