Skip to main content
Skynet
Skynet
New Member
June 20, 2025
Question

Remote Access IPsec VPN unable to PING

  • June 20, 2025
  • 2 replies
  • 3500 views

I have created an IPsec Remote Access VPN tunnel. When I connect to the tunnel I am unable to ping any interfaces or devices on the LAN. I have firewall policies to allow all traffic to and from the VPN-to-LAN traffic. I am wondering if the issue has to do with my Phase 2 selectors being 0.0.0.0/0 for the local and remote addresses. I do have a static route of 0.0.0.0/0 to the WAN interface, and if it matters there is a site-to-site VPN tunnel set up as well that I would like to be able to ping across to the other site's LAN. Thank you all for your assistance in advance. 

2 replies

raffaeledp
raffaeledp
Explorer III
June 20, 2025

Hello,

just a simple question. What's the network configured in the accessible networks inside the IPSec tunnel? Is the LAN you want to ping inside the "accessible networks". Otherwise all the traffic will be dropped.

Skynet
SkynetAuthor
New Member
June 20, 2025

The LAN is in the Accessible Networks, though it is the only thing listed; I am going to work on adding more networks here.

dingjerry_FTNT
Staff
dingjerry_FTNT
Staff
June 20, 2025

Hi @Skynet ,

 

Running debug flow commands will show you why Ping is not working. Since you did not tell us what your FGT firmware version is, I provide the article based on the latest version:

 

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/54688/debugging-the-packet-flow

 

My guess, based on what you said that there are correct firewall policies:

 

1) You don't have a static route created with your IPSec VPN tunnel.

2) You don't have ICMP/Ping enabled for the Administrative settings on the LAN interface.

 

 

Skynet
SkynetAuthor
New Member
June 20, 2025

I do have Ping enabled, however I do not have a Static Route configured for the Tunnel With me using 0.0.0.0/0 for the local address for Phase 2, I was unsure for what to put for the route for the VPN tunnel. Should I change the local address to the IP address that is showing up for the tunnel when you look at the interface?

dingjerry_FTNT
Staff
dingjerry_FTNT
Staff
June 20, 2025

Hi @Skynet ,

 

The one you configured in Phase 2 is referred to as the Selector, a terminology used in IPSec VPN phase 2.

 

This is for bringing up IPSec VPN, not for adding a static route in the routing table. 

Instead, we do have some settings in the IPSec VPN phase 1 settings to add static routes. 

 

So if you do not have a route entry for the remote peer, i.e., 10.0.0.0/24, with the IPSec VPN, once the traffic is out of the IPSec VPN tunnel, it will be dropped due to "Reverse Path Check failed".

 

You still need to create a route entry for the remote IPSec VPN peer to avoid the "Reverse Path Check failed" issue.

 

You may check this article for more info:

 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Routing-issue-reverse-path-check-fail-bad/ta-p/358875

Terms & ConditionsAccessibility statement