Skip to main content
Cornelis
New Member
May 9, 2020
Question

Site to Site VPN

  • May 9, 2020
  • 3 replies
  • 3412 views

Hi All

 

I wonder if someone could help me

 

i have created a site to site vpn between two fortigates.

 

Site A

VLAN: 172.168.0.0/24

Polices created to allow all 

 

Site B 

LAN: 192.168.1.0/24

Polices created to allow all 

 

The tunnel comes up successfully and i am able to ping from site B to site A but whenever i try to ping from site a to b it fails, however i am able to rdp into a machine from site a to b

 

Any guidance would be grateful to get ping to work

 

Many thanks 

    3 replies

    Toshi_Esumi
    SuperUser
    SuperUser
    May 9, 2020

    You already have Service: ALL enabled in the policies. Then if RDP works but can't ping the same machine, I would suspect the machine is not allowing ping while allowing RDP. But to make sure, I would run "diag packet sniffer" at Site-b FGT on the LAN interface.

    Cornelis
    CornelisAuthor
    New Member
    May 9, 2020

    Hi Toshi

     

    Thank you for the reply, ping is enabled on the machine. when i run the command how do i do that on the lan interface, sorry still new to networking.

     

    Many thanks

    Toshi_Esumi
    SuperUser
    SuperUser
    May 9, 2020

     diag sniffer packet <interface_name> 'host <ip_address_of_the_machine>'

     

    depending on your FGT model, you might need to disable ASIC off-loading on the policy with below.

     

     config firewall policy

     edit <id>

     set auto-asic-offload disable

     end

     

    If you do that, don't forget to enable it again once you're done sniffing.

    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT