Skip to main content
techinfofao
techinfofao
New Member
December 5, 2016
Question

VPN ipsec OK but ping not

  • December 5, 2016
  • 2 replies
  • 6899 views

Fortigate 60C

v5.2.7,build718 (GA)

 

Hi there.

I created a vpn ipsec between my FG60C and a Netgear FVS336G.

The vpn is up and hosts in my subnet can be ping from the remote subnet (behind the Netgear FVS336G).

I can ping hosts of the remote subnet with the Fortigate's CLI, but i can't with the cmd.exe of my PC (behind the FG60C).

All firewalls off.

Did i miss something ?

any help would be great, THX.

    2 replies

    techinfofao
    techinfofaoAuthor
    New Member
    December 5, 2016

    No replies ?

    Just tell me if my problem is not clear enough .

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    December 5, 2016

    I'm assuming you have a proper policy on the FG60C from local subnet to the remote one into the tunnel interface or zone. Then you need to sniff if it's actually going into the tunnel. If not, the next step would be flow debug to see why the FG is dropping the packets.

    But you generally wouldn't be able to ping the remote host from the FG unless you specify the source IP on the LAN side. Are you sure the policy doesn't have NAT on? What do you see as the source IP in sniffing when you ping from the FG?

    techinfofao
    techinfofaoAuthor
    New Member
    December 6, 2016

    Policy from local to remote subnet is OK.

    No NAT on  on both policy.

    What do you mean by "sniffing if it's actually going into the tunnel" ?

    Is there a specific command ?

    Thx.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    December 6, 2016

    This is the syntax of sniffing:

    http://kb.fortinet.com/kb/viewContent.do?externalId=11186

    then this is for flow debugging:

    http://kb.fortinet.com/kb/documentLink.do?externalID=FD33882

     

    Terms & ConditionsAccessibility statement