Server IP address could not be found for IPsec VPN Remote Access

Hello,

You may consider to collect debug flow and traffic sniffer while pinging unreachable server:

Debug flow:

diagnose debug flow filter daddr <server IP address>
diagnose debug flow filter proto 1
diagnose debug flow show function-name enable
diagnose debug flow trace start 100
diagnose debug enable

Traffic sniffer:

diagnose sniffer packet any 'icmp and host <server IP address>' 4 0 a

Is the server IP part of the subnet 192.168.1.x and does it use .1 as the gateway (or as a next hop in a route to reach the VPN subnet)? Check also the firewall of the server if it has any specific rule that allows or block based on source IP. If NAT is not enabled on the policy, the requests will be sourced by the IP of the VPN client.

Not sure how you set it up, but you might need to add a route in the firewall explicit for the tunnel range.

Because you are using NAT and it works, it looks like that's the issue

Hello Team,

 FortiGate device is attempting to establish a connection to the FortiGuard server at IP address 173.243.143.6. This IP address does not belong to the 192.168.1.x subnet, so it's unlikely that it uses .1 as the gateway within that subnet.

Regarding firewall rules on the server, it's essential to check if there are any specific rules that might be blocking traffic from the source IP addresses of the FortiGate device or VPN clients. If there are restrictive firewall rules in place, they could potentially block the communication between the FortiGate device and the FortiGuard server.

Additionally, if NAT is not enabled on the firewall policy that allows traffic from the FortiGate device to reach external servers like the FortiGuard server, the requests will indeed be sourced by the IP of the VPN client. This means that the firewall rules on the server should allow traffic from the VPN client IPs as well, not just from the FortiGate device's IP.

In summary, it's crucial to:

1. Check if the FortiGuard server's IP address is within the 192.168.1.x subnet and if it uses .1 as the gateway (if applicable).
2. Review firewall rules on the server to ensure they allow traffic from both the FortiGate device's IP and the VPN client IPs.
3. Consider enabling NAT on the firewall policy if necessary, to ensure that requests are sourced correctly.

Thank you.