Site-to-Site No Longer Passing Traffic

Question

I have a site-to-site VPN setup between two Fortigate fws. This VPN has been setup for years and have had no issues. Yesterday, I lost the ability to communicate to either LAN between the VPN. The tunnel shows as up on both sides and I've tried rebooting, resetting the connection, and still nothing. Before yesterday I could communicate successfully between both sites but now nothing. It is also an IPsec VPN. Any ideas?

I also have other VPNs on each firewall (none other are Site to Sites) and they each work.

Version 5.6 on one side and 7.4.3 on the other.

kaman · Answer

Hi itkzombie,

As you informed IPSsec tunnel is up and you facing an issue of traffic through the tunnel is not working

Please provide the following CLI commands output on both the firewall:

get system status
get router info routing all
diag vpn tunnel list name <IPSec tunnel name>

Provide the given debug flow command when you generate traffic

diag debug reset
diag debug en
diag debug flow filter saddr x.x.x.x
diag debug flow filter daddr y.y.y.y
diag debug flow show function-name en
diag debug flow trace start 255
diagnose debug console timestamp enable

Where x.x.x.x is Source IP and y.y.y.y is Destination IP

Once you collected the debug output, disable debug with

diag debug reset
diag debug dis

CLI2:
Ping the destination IP address and run the below command on both firewalls and see the incoming and outgoing packets:

diagnose sniffer packet any ' host x.x.x.x and host y.y.y.y ' 6 0 l

Where x.x.x.x is Source IP and y.y.y.y is Destination IP

Please refer to the below documents for more information:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPN-is-up-but-network-is-not-reachable/ta-p/192887
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-Tunnel-up-but-no-traffic-is-being/ta-p/217330

Regards,
Aman

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded