VPN Troubleshooting

Hi Mario,

If the IPsec tunnel is successfully established but internal resources are not reachable, the next step is to verify the traffic path through the tunnel rather than the tunnel establishment itself.

I would check the following on the FortiGate:

1. Phase 2 selectors – Confirm that the VPN client/remote subnet and the internal destination subnet are included in the Phase 2 configuration.
2. Routing – Verify that the FortiGate has an active route to the internal destination through the appropriate IPsec tunnel.
3. Firewall policy – Confirm that a policy permits traffic from the IPsec tunnel to the internal network, with the expected source and destination addresses.
4. Return path – Make sure the internal network has a valid route back to the VPN client/remote subnet. The tunnel can be UP while return traffic follows an incorrect path.

Fortinet's troubleshooting guidance for an IPsec tunnel that is UP but cannot reach the network covers these areas, including Phase 2 selectors, routing, and firewall policy:

IPsec VPN is up but network is not reachable

In short, an established IPsec tunnel confirms that the VPN negotiation succeeded, but it does not by itself confirm that user traffic can reach the internal network. Verifying the selectors, route, firewall policy, and return path will help isolate where the connectivity breaks.

If those items are correct, the next useful step is to trace one specific connection from a VPN client to one internal IP to identify where the traffic is being dropped.

Hope this helps!