Problem with ipsec tunnel mikrotik fortigate

Forum|Forum|5 years ago
August 6, 2021
2 replies
3129 views

Hello i have a litle problem. Tunnel is establised but fortigate cant ping mikrotik and mikrotik cant ping fortigate.

1. Mikrotik LTE 192.168.77.1 is connect to fortigate via ethernet cable. Fortigate have address 192.168.11.254. And to mikrotik connect via ethernet cable PC1 and he have address from fortigate 192.168.11.110

2. Mikrotik LTE2 192.168.14.254 and he cant ping 192.168.11.254 but PC2 connect wireless from mikrotik lte2 and have ip 192.168.14.100and he pinging 192.168.11.254 (frotigate)

What is wrong? I use NAT-T to ipsec

abarushka

Staff

Hello,

I would recommend to collect debug flow and traffic sniffer in order to check whether traffic is reaching FortiGate, entering the tunnel and return traffic. In case there is no return traffic I would recommend to check whether traffic is received on Mikrotik site. In case traffic is lost between FortiGate and Mikrotik you may consider to decrypt ESP packets. Please find the details by following the link below:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Decrypt-ESP-packets/ta-p/198431?externalID=FD48280