Routing between vpn tunnels

There are three things to check at all three parties. 1) routing, 2) policies, and 3) phase2 network selectors. Are you sure the selectors on both VPNs include [vm1 subnet]<->[vm2 subnet]?

Also both vm sides need to know routing into the tunnel to get to the other vm.

Toshi

Hi @aresblade ,

Always run the debug flow commands first to tell why the packets were being dropped.

Please check this KB article and try the steps in the Debug Flow section:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connectivity/ta-p/192560

Hi aresblade,

collect the pcap on both the firewall

diag sniff packet any 'host x.x.x.x and y.y.y.y and icmp' 4 0 l >> where x and y is src and dst ip

verify if the subnets are allowed in quick mode selectors

HI thank you all for the tips, after some troubleshooting, i have found this:

traffica from vm in azure is going trought the fw fortigate on azure i see ip from port 2 in , and out to the vpn tunnel interface but no reply, so the out from azure works.

gcp side i see on the fortigate onprem where gcp tunnel is connected that the gcp vm ip comes in and out to the azure vpn tunnel, but no reply.

bot vm can ping the onprem fortigate on the lan interface, i have all the routing on both sides gcp 

on the onprem fortigate i have a route to gcp trought the gcp tunnel, and a route to azure trought the azure vpn tunnel

gcp has route to azure

azure has route to gcp

i think the problem is on the fortigate on prem that need to route the two vpn tunnels

ping from gcp to azure is logged on the on prem fortigate

i see it in and out, but ping from azure to gcp is not loggend on prem but on the fortigate in azure

I'm stuck, i don't know where to look for troubleshoot

this is the log from fortigate on prem

the ping is from gcp vm to azure vm

gcp ip is 10.20.0.2

azure ip is 172.16.4.

FortiHome # diagnose sniffer packet any "(host 172.16.4.4 and host 10.20.0.2) and icmp" 4
interfaces=[any]
filters=[(host 172.16.4.4 and host 10.20.0.2) and icmp]
0.195505 gcplab in 10.20.0.2 -> 172.16.4.4: icmp: echo request
0.195534 AzureFGT out 10.20.0.2 -> 172.16.4.4: icmp: echo request
5.204783 gcplab in 10.20.0.2 -> 172.16.4.4: icmp: echo request
5.204818 AzureFGT out 10.20.0.2 -> 172.16.4.4: icmp: echo request
10.196411 gcplab in 10.20.0.2 -> 172.16.4.4: icmp: echo request
10.196438 AzureFGT out 10.20.0.2 -> 172.16.4.4: icmp: echo request

this is the log on the azure fortigate 

 i ping from the azure vm to gcp vm

fortigate-FGT # diagnose sniffer packet any "(host 172.16.4.4 and host 10.20.0.2) and icmp" 4
Using Original Sniffing Mode
interfaces=[any]
filters=[(host 172.16.4.4 and host 10.20.0.2) and icmp]
3.818607 port2 in 172.16.4.4 -> 10.20.0.2: icmp: echo request
3.818624 HemlabFGT out 172.16.4.4 -> 10.20.0.2: icmp: echo request
8.806086 port2 in 172.16.4.4 -> 10.20.0.2: icmp: echo request
8.806103 HemlabFGT out 172.16.4.4 -> 10.20.0.2: icmp: echo request
13.816910 port2 in 172.16.4.4 -> 10.20.0.2: icmp: echo request
13.816927 HemlabFGT out 172.16.4.4 -> 10.20.0.2: icmp: echo request
18.826174 port2 in 172.16.4.4 -> 10.20.0.2: icmp: echo request
18.826190 HemlabFGT out 172.16.4.4 -> 10.20.0.2: icmp: echo request
23.822916 port2 in 172.16.4.4 -> 10.20.0.2: icmp: echo request
23.822933 HemlabFGT out 172.16.4.4 -> 10.20.0.2: icmp: echo request
28.824937 port2 in 172.16.4.4 -> 10.20.0.2: icmp: echo request
28.824953 HemlabFGT out 172.16.4.4 -> 10.20.0.2: icmp: echo request
^C
12 packets received by filter
0 packets dropped by kernel

fortigate-FGT #

6 packets received by filter
0 packets dropped by kernel

FortiHome #