Skip to main content
Alex_K
Alex_K
New Member
April 25, 2016
Question

Site-to-site between 100D and AWS

  • April 25, 2016
  • 1 reply
  • 13509 views

Hello Everyone!

 

I would appreciate if someone could shed some light on my issue with IPSec VPN tunnel.

 

I have a pretty simple setup: Local Network (10.110.0.0/16), AWS VPC (172.10.10.0/24), and 100D firewall. I downloaded configs from AWS and build 2 redundant tunnels, which are up and passing "some" traffic. Everything is setup to pass all traffic from and to AWS without any explicit rules. I do interface-based VPN, so static route is setup to send all 172.10.10.20/24 traffic to VPN interface. The problem I'm having is that I can ping from AWS anything on 10.110.0.0 network, but I can't ping any AWS instances from my LAN.

I'm using "diagnose sniffer packet "MY_INTERFACE"" to see what's going on with the traffic and what I found out is, when I ping from my LAN, sniffer shows "279.429024 169.254.X.X -> 172.10.10.222: icmp: echo request" and I don't get any replies. However, if I specify source interface for my pings to be my firewall's local IP, I get replies back and sniffer shows the following "1208.781932 10.110.1.200 -> 172.10.10.222: icmp: echo request, 

1208.821932 172.10.10.222 -> 10.110.1.200: icmp: echo reply".

I have similar tunnels (and they work as expected) from other locations and everything looks the same to me (I didn't setup original firewalls, but I built the network infrastructure in Amazon, so all static routes in Amazon are correct).

 

 

Thank you in advance!

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    April 25, 2016

    hi,

     

    and welcome to the forums.

    You are using an APIPA IP address for your PC which is not routed across the tunnels. Supply a correct IP address from the local 10.110.1.x subnet and I bet it'll work.

    Alex_K
    Alex_KAuthor
    New Member
    April 25, 2016

    ede_pfau

     

    I have a layer3 switch (10.110.1.1) in my LAN which has only one vlan setup 10.110.0.0/16 and route all 0.0.0.0 traffic to 10.110.1.200 (FW). So all computers that have static IPs with 10.110.1.1 as their default gateway have no issues communicating with each other and internet thru FW.

    Also, it doesn't matter if I'm pinging from a computer connected to the switch or from FW using its console.

    emnoc
    emnoc
    New Member
    April 25, 2016

    The diag debug flow filter command is your friend in this . It's probably due to a fwpolicy or snat enabled where it should be not. Ede is 100% in the earlier diagnostic but I would do a diag debug flow with a filter on the source /destination and review any output.

     

     

    Terms & ConditionsAccessibility statement