Troubleshooting Tip: zero bytes showing for incoming and outgoing data bytes in IPsec VPN monitor

samandeep · ‎08-18-2024

Description

This article describes why zero bytes show for incoming and outgoing traffic once both phases of the IPsec tunnel are UP.

Scope

FortiOS 7.x.x.

Solution

There are some possible causes:

Phase-2 Configuration is incorrect: Phase-2 selectors are mentioned in the configuration those are not the actual subnet, generating packet/data.
Firewall Policy: It is possible that dedicated local and remote subnets are not added in the Firewall policy, however, check other matching criteria as well such as Incoming and outgoing interface, services, schedule and action 'DENY' or 'ALLOW'.
Routing: Ensure that for VPN traffic, FortiGate must proper routes for remote subnets and also check the routing table both Local firewall and remote firewall side and routes must be active.
Device availability: There is no device connected to local FortiGate, generating traffic to remote side.
To resolve these kinds of issues.

Check the routing table using below command on both sides.

get router info routing-table details <destination (remote site)>

Ensure that output shows VPN interface.

Run continuous ping from local site to another site.

This can be done by device connected to the FortiGate LAN interface.

ping <remote IP> -t

if there is no device available, ping test can also be executed from the FortiGate CLI. In that case, specify the source IP.

exe ping-options source <FortiGate internal interface IP(also be part of Phase2 selector of phase-2)>

exe ping-options repeat count 99

exe ping <remote IP>

Run packet sniffer and debug flow command both sides.

CLI 1:

diagnose sniffer packet any “host <destination-IP> and icmp” 4 0 l

CLI 2:

diagnose debug reset

diagnose debug flow filter <destination-IP> <Source-IP> and

diagnose debug flow show function-name enable

diagnose debug flow show iprope enable

diagnose debug console timestamp enable

diagnose debug flow trace start 999

diagnose debug enable

To stop the debug:

diag debug dis

Check the flow filter and look for 'offloading' or 'drop'.

If the results are showing on the one side, check for the ESP packets. Run the following sniffer on both sides.

diag sniffer packet any “host <remote-gateway-IP> and esp” 4 0 l

If there are no ESP packets and only port 500 traffic, it is possible that ESP packets are being dropped in transit.

In order to test, force the NAT-T on the phase1 configuration of the FortiGate.

After, look for port 4500 traffic using the following packet sniffer's command.

diag sniffer packet any “host <remote-gateway-IP> and port 4500 ” 4 0 l

If traffic is still not showing in the IPsec monitor, raise a ticket with TAC with all of the above information.

Related articles: