tunnel up but cant reach lan behind fortigate

Thank you emnoc for ypur replay forigate configuration is # show vpn ipsec phase1 config vpn ipsec phase1 edit " site2site" set interface " wan1" set keylife 86400 set proposal aes128-sha256 set remote-gw 6.x.x.x set psksecret ENC A3t/JwWnow5Og98L2qOVhGlzcCyTIrdDA2jY/tB8Ae6w/V+fzFyGiu+pZ/Cgd67xaJKkAwl+41yms next end # show vpn ipsec phase2 config vpn ipsec phase2 edit " site2sitev2" set keepalive enable set phase1name " site2site" set proposal aes128-sha256 set replay disable set dst-subnet 10.10.10.0 255.255.255.0 set keylifeseconds 86400 set src-subnet 10.0.0.0 255.255.255.0 next end # show firewall policy 5 config firewall policy edit 5 set srcintf " wan1" set dstintf " internal" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " ALL" set utm-status enable set logtraffic disable set av-profile " default" set webfilter-profile " default" set spamfilter-profile " default" set ips-sensor " default" set application-list " default" set profile-protocol-options " default" set nat enable next end cisco configuration is crypto isakmp policy 10 encr aes hash sha256 authentication pre-share group 5 crypto isakmp key 6 key address 4.x.x.x no-xauth ! ! crypto ipsec transform-set myset esp-aes esp-sha256-hmac ! crypto map kon-map 10 ipsec-isakmp set peer 4.x.x.x set transform-set myset set pfs group5 match address 105 ip nat inside source list 100 interface Dialer1 overload ip route 0.0.0.0 0.0.0.0 Dialer1 ! access-list 100 deny ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255 access-list 100 permit ip 10.10.10.0 0.0.0.255 any access-list 100 permit ip 192.168.16.0 0.0.0.255 any access-list 105 permit ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255 ============================== my cisco router output is #sh crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 6.x.x.x 4.x.x.x QM_IDLE 2004 ACTIVE IPv6 Crypto ISAKMP SA ============================== #show crypto ipsec sa interface: Dialer1 Crypto map tag: kon-map, local addr 6.x.x.x protected vrf: (none) local ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0) current_peer 4.x.x.x port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9 #pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 1, #recv errors 0 local crypto endpt.: 6.x.x.x, remote crypto endpt.: 4.x.x.x path mtu 1492, ip mtu 1492, ip mtu idb Dialer1 current outbound spi: 0xCE9BAB47(3466308423) PFS (Y/N): Y, DH group: group5 inbound esp sas: spi: 0xA6EAF22D(2800415277) transform: esp-aes esp-sha256-hmac , in use settings ={Tunnel, } conn id: 1009, flow_id: SW:9, sibling_flags 80000046, crypto map: kon-map sa timing: remaining key lifetime (k/sec): (4529363/2902) IV size: 16 bytes replay detection support: Y Status: ACTIVE inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0xCE9BAB47(3466308423) transform: esp-aes esp-sha256-hmac , in use settings ={Tunnel, } conn id: 1010, flow_id: SW:10, sibling_flags 80000046, crypto map: kon-map sa timing: remaining key lifetime (k/sec): (4529363/2902) IV size: 16 bytes replay detection support: Y Status: ACTIVE outbound ah sas: outbound pcp sas: interface: Virtual-Access1 Crypto map tag: kon-map, local addr 0.0.0.0 protected vrf: (none) local ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0) current_peer 4.x.x.x port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 0.0.0.0, remote crypto endpt.: 4.x.x.x path mtu 1492, ip mtu 1492, ip mtu idb Virtual-Access1 current outbound spi: 0x0(0) PFS (Y/N): N, DH group: none inbound esp sas: inbound ah sas: inbound pcp sas: outbound esp sas: outbound ah sas: outbound pcp sas: =================================================== fortigate output is # diag vpn tunnel list list all ipsec tunnel in vd 0 ------------------------------------------------------ name=site2site ver=1 serial=1 4.x.x.x:0->6.x.x.x:0 lgwy=static tun=tunnel mode=auto bound_if=5 proxyid_num=1 child_num=0 refcnt=7 ilast=0 olast=0 stat: rxp=11 txp=11 rxb=1164 txb=1020 dpd: mode=active on=1 idle=5000ms retry=3 count=0 seqno=1440 natt: mode=none draft=0 interval=0 remote_port=0 proxyid=site2sitev2 proto=0 sa=1 ref=2 auto_negotiate=0 serial=1 src: 0:10.0.0.0/255.255.255.0:0 dst: 0:10.10.10.0/255.255.255.0:0 SA: ref=5 options=0000000d type=00 soft=0 mtu=1408 expire=1259 replaywin=0 seqno=2 life: type=01 bytes=0/0 timeout=3548/3600 dec: spi=ce9bab47 esp=aes key=16 0eee42e294225bc776d16faf15980acb ah=sha256 key=32 2cac8b9529db04758d75c15a80f2ad73c33e158df9342c3af57af9417777688b enc: spi=a6eaf22d esp=aes key=16 d3ebccccd38dcdcf7a25bc618b6762ea ah=sha256 key=32 a4ad4e7b9fc4a8edc29f5870552020c33c6252ec384ab51c85a8656a58d1327b npu_flag=03 npu_rgwy=62.114.252.42 npu_lgwy=41.33.196.90 npu_selid=0, dec:pkts/bytes=2/200, enc:pkts/bytes=11/1092 ------------------------------------------------------ name=forti-vpn ver=1 serial=2 4.x.x.x:0->0.0.0.0:0 lgwy=static tun=intf mode=dialup bound_if=5 proxyid_num=0 child_num=0 refcnt=4 ilast=7773 olast=7773 stat: rxp=0 txp=0 rxb=0 txb=0 dpd: mode=active on=0 idle=5000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 ========== # diag vpn ike status connection: 1/2 IKE SA: created 1/2 established 1/1 times 8640/8640/8640 ms IPsec SA: created 1/1 established 1/1 times 190/190/190 ms ========================================== when ping from cisco router to lan behind fortigate I acn ping only internal interface of fortigate #ping 10.0.0.1 source vlan1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds: Packet sent with a source address of 10.10.10.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 48/164/384 ms r#ping 10.0.0.100 source vlan1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.0.0.100, timeout is 2 seconds: Packet sent with a source address of 10.10.10.1 ..... Success rate is 0 percent (0/5)

sorry for mistake the right policy I used # show firewall policy 1 config firewall policy edit 1 set srcintf " lan" set dstintf " wan1" set srcaddr " hq-network" (10.0.0.0/24) set dstaddr " kon-network" (10.10.10.0/24) set action ipsec set schedule " always" set service " ALL" set inbound enable set outbound enable set vpntunnel " site2site" next end ---- I can ping cisco router 10.10.10.1 from the firewall but cant from pc in fortigate lan 10.0.0.0/24

Thanks emnoc no output from The diag debug flow command -site A have leased line with 6 Mbps (upload =768 kbyte download =768 kbyte ) -site B have Adsl connection 4 Mbps (upload =128 kbyte downlaod=512 kbyte)