Skip to main content
emerge
emerge
New Member
July 9, 2019
Question

VPN site to site issues

  • July 9, 2019
  • 1 reply
  • 5722 views

I'm pretty new to the Fortigate firewalls and trying to figure out where I'm possibly going wrong with the VPN site to site I have setup with another company. I am able to make a healthy connection between both sites and the vpn connection shows active but there is no traffic showing between them.  The other company says that they are unable to ping one of my servers but I can see their ping test through the ipsec monitor in the incoming data.  I am unable to ping their side from the server.  I went into the CLI of the fortigate and did an execute ping to 3 of their networks and was able to ping all 3 of the IPs.  So it seems like I am able to successfully ping through the firewall, but If I ping from a device on the network I cannot reach their end and vice versa.  Hopefully someone can point me in the right direction on what to check as I am completely unfamiliar with these particular brand of firewalls.

    1 reply

    hubertzw
    hubertzw
    New Member
    July 10, 2019

    Can you show the output from the below command?

     

    diagnose sniffer packet any 'host X.X.X.X'

     

    1) when you ping the partner IPs

    2) when they try to ping your server

     

    When you can ping them from FGT it can be routing or policy issue. Can you show your selectors (IP or subnet)? Are you sure the source IP of the host in your network is within the range you set on the FGT as the source?

    emerge
    emergeAuthor
    New Member
    July 10, 2019

    Absolutely,

     

    1) When I ping their network

     
    TV-FW-60D # diag sniffer packet any "host 10.254.0.2"
    interfaces=[any]
    filters=[host 10.254.0.2]
     
    0 packets received by filter
    0 packets dropped by kernel

     

    2) On their end a week ago the tech did a tcmpdump and stated that he see's a udp encapsulated ipsec packet sent to our WAN address and can see his ping traversing the vpn connection but no response packet

    # tcpdump -nn net 172.21.1.0/24
    23:29:42.788605 IP 10.33.0.9 > 172.21.1.7: ICMP echo request, id 31588, seq 1, length 64
    23:30:03.973789 IP 10.33.0.9 > 172.21.1.7: ICMP echo request, id 31696, seq 1, length 64
    # tcpdump -nn 'net 50.254.200.220'
     
    23:29:42.788636 IP 10.33.252.205.4500 > 50.254.200.220.4500: UDP-encap: ESP(spi=0x170f4be0,seq=0xa), length 132
    23:29:49.307656 IP 10.33.252.205.4500 > 50.254.200.220.4500: NONESP-encap: isakmp: phase 2/others ? inf
    23:29:49.329883 IP 50.254.200.220.4500 > 10.33.252.205.4500: NONESP-encap: isakmp: phase 2/others ? inf
    23:29:57.450404 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:57.450550 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:57.450670 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:57.450830 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:57.451292 IP 10.33.252.205.4500 > 50.254.200.220.4500: isakmp-nat-keep-alive
    23:29:59.114239 IP 10.33.252.205.4500 > 50.254.200.220.4500: NONESP-encap: isakmp: phase 2/others ? inf
    23:29:59.137438 IP 50.254.200.220.4500 > 10.33.252.205.4500: NONESP-encap: isakmp: phase 2/others ? inf
    23:30:03.973823 IP 10.33.252.205.4500 > 50.254.200.220.4500: UDP-encap: ESP(spi=0x170f4be0,seq=0xb), length 132

    I've attached an image of the Phase 2 selectors (using named address)
      
     
    rwpatterson
    rwpatterson
    New Member
    July 10, 2019

    You also need to have static routes in place for those remote networks that point down the tunnels. Make sure the distance is lower than the default gateway.

     

    Also ensure that you have policies in place that start from your side for outgoing originating traffic as well as policies that start from the remote side for incoming originating traffic.

    Terms & ConditionsAccessibility statement