Skip to main content
DasYeti
New Member
September 1, 2020
Question

Site-to-site VPN traffic issues to AWS VPC

  • September 1, 2020
  • 4 replies
  • 7765 views

I have inherited a Fortigate 60E running 5.4.4.  I am attempting to setup a VPN connection to a AWS VPC (setup with instructions from https://docs.fortinet.com/document/fortigate/6.2.0/aws-cookbook/506140/connecting-a-local-fortigate-to-an-aws-vpc-vpn) .  I have established the connection and the tunnel is up.  I can ping from an EC2 instance in the VPC to devices in my local office.  However, I cannot ping items in the VPC from my local office.  When trying to do a tracert, it doesn't even make one hop before failing (as if traffic is not routing from the local subnet to the AWS subnet).  Pinging the public IP is successful.  Unfortunately, I am not that familiar with the fortiOS which is making things more challenging as it is not very intuitive to me.

 

I have static routes configured to hit the AWS subnet

I've been trying some different IPv4 policy setting to no avail

phase2 on the VPN is set to 0.0.0.0/0.0.0.0 for both local and remote.

 

I am at a loss as to where to look next.  Any guidance would be apprciated.

 

 

 

 

 

    4 replies

    Yurisk
    SuperUser
    SuperUser
    September 2, 2020

    There are quite a few things that cause such behavior, hard to say without seeing the config, but ...

    - Make sure NAT is not enabled on the security rule from LAN to VPC LAN.

    - Make sure routing is correct: # get route info routing all

    - Do a sniffer to see if your pings from LAN reach and exit the correct interface, say your lan in VPC is 10.10.10.0/24:

    # dia sni packet any 'icmp and 10.10.10.0/24' 

     

    HASimac
    New Member
    September 2, 2020

    Hi,

     

    Be sure to disable source/destination check on each EC2 instance you want to reach...

     

    Regards,

     

    HA

    SanZ
    Explorer
    September 2, 2020

    Can you share config? 

     

    emnoc
    New Member
    September 3, 2020

    I wrote this 5+ years ago and nothing really has change , you might want to study your config and compare

     

    http://socpuppet.blogspot.com/2014/02/dual-vpc-terminate-on-fortigate-firewall.html

     

    Ken Felix