Adding a second VPN Tunnel with Cisco ASA

[FGTnewbie]

Hello everyone 

Im trying to add a second VPN tunnel to our fortigate. everything seems ok and the tunnel is up but no communication between the two sites. 

Trace route on CLi on fortigate just drops 

Traceroute from lan goes to the internet and drops 

I used a wizard to create the tunnel. On our side we have Fortigate 200D and the other end is  a Cisco ASA

diag gateway list results below 

vd: root/0

name: XXXXXXXXXXXXX

version: 1

interface: port6 15

addr: XXXXXXXXXXXX:500 -> XXXXXXXXXXXXX:500

created: 5038s ago

IKE SA: created 1/1  established 1/1  time 630/630/630 ms

IPsec SA: created 5/85  established 5/5  time 180/358/800 ms

  id/spi: 2 e9e783ffee4b81ee/557d82bf62f157f8

  direction: initiator

  status: established 5038-5037s ago = 630ms

  proposal: aes256-sha1

  key: f1cf0d0329195bdc-683d8c0d7660f9ce-af2786dfc8dd072b-310f90e043bc78a9

  lifetime/rekey: 43200/37862

  DPD sent/recv: 00000000/00000000

vd: root/0

name: YYYYYYYYYYYYYYYYY

version: 1

interface: port6 15

addr: YYYYYYYYYYYY:500 -> YYYYYYYYYYYYYYYY:500

created: 443s ago

IKE SA: created 1/1  established 1/1  time 670/670/670 ms

IPsec SA: created 1/1  established 1/1  time 890/890/890 ms

  id/spi: 16 144ca8e0a32ae987/128dced7496e5590

  direction: initiator

  status: established 443-442s ago = 670ms

  proposal: aes256-sha1

  key: 1ea51db8c63bf1e9-73cc692d2d2fa48f-f14ad0ffe946bccf-6712eab0676207db

  lifetime/rekey: 86400/85657

  DPD sent/recv: 000038d2/00000000

Any idea of what i'm doing wrong? 

[FGTnewbie]

it was the same but ive just made it lower now.

[rwpatterson]

The same won't work.

Rather... The same may not work. If the two are the same, the FGT will choose which path to take to reach the remote subnet. By using a lower distance, you force the FGT to use the path you chose.

[FGTnewbie]

ive made it lower and still no luck

[Nils]

If the traffic goes out on the internet interface there's something wrong with the routing or the local/remote subnet specified in the tunnel configuration.

Are you sure you're using Interface based VPN?

And your static route is pointing on the IPSEC interface?

Btw..

Have you tried to turn off DPD?

[Nils]

Can you post the result of "get router info routing-table all"

[FGTnewbie]

# get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default S* 0.0.0.0/0 [10/0] via 62.173.44.193, port6 S 10.6.4.108/30 [5/0] via 10.38.0.33, port3 S 10.10.16.0/24 [10/0] via 10.38.0.33, port3 C 10.38.0.32/28 is directly connected, port3 C 62.173.44.0/24 is directly connected, port6 is directly connected, port6 C 62.173.44.192/30 is directly connected, port6 S 192.168.0.0/24 [10/0] is directly connected, VPN 1 C 192.168.1.0/24 is directly connected, port2 S 192.168.6.0/24 [10/0] is directly connected, VPN 1 S 192.168.14.0/24 [10/0] is directly connected, VPN 1 C 192.168.20.0/24 is directly connected, port5 C 192.168.21.0/24 is directly connected, port4 C 192.168.40.0/22 is directly connected, port7 S 192.168.44.0/24 [5/0] via 10.38.0.43, port3 S 192.168.45.0/24 [5/0] via 10.38.0.44, port3 --More-- S 192.168.46.0/24 [5/0] via 10.38.0.37, port3 --More-- S 192.168.47.0/24 [5/0] via 10.38.0.39, port3 --More-- S 192.168.48.0/24 [5/0] via 10.38.0.46, port3 --More-- S 192.168.49.0/24 [10/0] via 10.38.0.33, port3 --More-- C 192.168.100.0/24 is directly connected, lan

[FGTnewbie]

Now the VPN is down and it no longer coming up 

[Nils]

To me it looks like you have the same Distance configured on the default route and the route to VPN interface.

Try to change the distance to 5 on the VPN interface.

[FGTnewbie]

Thanks so much Nilsan. Ill try that and lt you know how it goes 

[FGTnewbie]

Hi Nissan i changed the default route and still the same issue. I think that the problem is from the Cisco ASA side